Insisting on it being a hierarchy is an easy way to get into trouble. Eventually, you&#x27;ll want to give someone &quot;just one more permission&quot;<p>It&#x27;s more flexible to have a composition of roles, such as &quot;UserCreator + FinanceReportRunner&quot; or something like that.