I think you are confusing roles with permissions.<p>Admin is a role, can_delete_everything is a permission.<p>Users are assigned a role. A role can have one or many permissions.<p>Program code checks for specific permissions.<p>Example: username =&gt; swalsh, role =&gt; hn_subscriptor, permission =&gt; can_post, permission =&gt; can_upvote.