Roles & LDAP
Role → permission matrix + LDAP directory binding — non-device software (FD&C Act §520(o)(1)(D))