Add `permissions` field for `Role` * `"*"` - can execute any core contract * `""` - access just host APIs, no right to execute any contracts with roles * `[]rolenames` - execution right to these roles