Permission system

Implement a RBAC with granular PBAC override system that can grant or deny permissions.

Order of access control evaluation (pseudo-code, entity structure purely indicative and inaccurate):

ASSUMING User u, Permission p, Department d, Session s

IF u.is_admin AND s.godmode                 -> accept
IF p in u.overrides[d].deny                 -> reject
IF p in u.overrides[d].allow                -> accept
IF \E Role r in u.roles[d], p in r.grants   -> accept
DEFAULT                                     -> reject