speaking of implied roles, is there ROLE INHERITANCE? haven't checked (I'd vote for multiple inheritance btw, inheriting from a list of other roles (with some loop checking)
</br>if there was, it would be easy to say that "Users" role inherits from "CannotSeePageBar" and then for any user we want to be able to see the bar we'd add "CanSeePageBar"
</br>obviously the system would treat inherited/implied roles as being of less priority, e.g. CanSeePageBar being assigned to a user would override the CannotSeePageBar that would be inherited from Users role.
</br>of course such overrides would be hardcoded in the system - maybe it would be cleaner to have parametric roles, e.g. CanSeePageBar<true> / CanSeePageBar<false> instead of CanSeePageBar and CannotSeePageBar, but could be too much