Each role has one decision per page: view, create, edit, delete. Pick a role to edit it on its own screen. Saving also gates the sidebar, so a role without View on a page loses both the menu item and the URL. The API enforces its own checks on every endpoint, so this screen sets policy, it does not replace security.