Grant access by role, with permissions that write themselves

Every screen yields its create, see, update and delete permissions when you seed, and the roles screen shows them as a matrix you tick. A role that cannot read a screen never sees it in the menu.