It was uncovered that ClusterPermission objects can have clusterRole and roles properties. clusterRole is singular and only contains one cluster role, where as roles is an array and can contain multiple roles.

Schema example showing additional options:

https://github.com/Ginxo/console/blob/main/frontend/src/routes/AccessControlManagement/schema.json

Yaml example of clusterRole and roles:

https://github.com/stolostron/cluster-permission/blob/main/config/samples/rbac.open-cluster-management.io_v1alpha1_clusterpermission.yaml

In my opinion, I think we can keep the UI simple and not allow roles and clustereRole customization. However we should allow customization through the yaml editor, and we need to be able to at least handle these types of configurations without the UI crashing.

Decide with stakeholders first if the above idea is OK to keep it simple.