We discussed having the authorization (authz) system ("actions" attached to "roles") being named with NSIDs instead of fixed strings.
I think this probably makes sense for the actions, i'm not sure about the roles: we probably want it to be easy to define and customize roles as simple records within the group (as things are now)?
Action NSIDs could be lexicon tokens, or they could be permission-set schemas. The permission set wouldn't need to fully encapsulate the authz semantics: the NSIDs would be known to the specification, and could have special behaviors.
