Managing complex permission sets

[Mailstorm-ctrl]

How is everyone doing it? We might be getting into a situation where we need to get real crafty with permissions and am wondering how others do it. Some examples of what kind of things we'd do:

• Limit users of group x to only create/edit specific device roles in a specific tenant (IE: only create/edit printers in tenant1)
• Same as above, but include Delete
• Limit users of group x to only edit IPs that are in a specific tenant and assigned to a device with a role
• RO access to certain device roles or tenant