good list. a just had a "complicated thing" non-bug yesterday because someone didn't realize permissions are additive and the user had multiple roles.