Right, those are the kind of permissions I had trouble with. That gist works for reads based on membership (even if a little unintuitive), but I couldn't figure out how do writes that validate using roles & permissions.