[schemers]

fine-grained access control is definitely the goal long term. We took a minor step towards that with per-domain admins, and once we get fullblown group support into the server we can then use them for "roles"...