The creation of new roles at runtime is not supported by ocaml_authorize, but I don't think such functionality is strictly necessary.
Yes, if you need additional flexibility you can create roles that look like Manager of Uuidm.t, which I believe covers the behaviour we want to achieve.
The creation of new roles at runtime is not supported by
ocaml_authorize, but I don't think such functionality is strictly necessary.