Solution seems interesting - never really questioned the paradigm of coupling perms with app code before. I can see how it can become unsustainable quite quickly as the company scales though.