Replace role permissions

Atomically replace all permissions on a role. System roles enforce a minimum permission floor.