Who can do what, right now.

Capability-first. Not Users. Not Roles. Not Permissions. Every authority your organization grants — and who currently holds it — at a moment you choose.