Permission and role based access system

[JSPRH]

Description

Currently, we are using a hierarchical role-based access system. However, we are already reaching limits of this system with a hand-full of pre-defined roles as we have very different needs (access only a small part of the content but be able to edit vs. access a lot of the content but read-only). For now, we will stay with the role-based access system but eventually, we have to come up with a more extensible solution.

Additionally, the roles are currently hard-coded. Eventually, we will need a solution where every org can define their own roles and permissions.

This issue is supposed to collect any discussion and thoughts about authorization system to make an informed decision.