Two hundred operators with two hundred hand-written permission documents will drift, one edit at a time. goca's answer: give the permission set a name once — a Group with roles, template and CA scopes — and let identities join it with a one-line binding. "Who can issue through the DMZ interface?" becomes the group's member list, not a question you answer by reading every binding.
You do not start from an empty page. First boot seeds four groups: goca-enrollment-operators (the exemplar — you add the interface it gates), goca-ca-operators, goca-template-authors, and goca-auditors. They are yours to edit or delete, and your edits are never overwritten by a restart.
Semantics worth memorizing: effective permission is the union of an identity's groups; roles resolve at login, so removing someone takes effect at their next sign-in; groups do not nest — "why does this person have this" must fit in a sentence. Writing a group needs system-admin, because it grants to every member.
Now I can grant a team access with one group instead of twenty documents.