[winrid]

I explicitly said can't use roles (groups). :)

But yeah, that's the cleanest way to go, if you can.

[janto]

Can you encrypt the role names for when it might be seen by a user?