Permissions specifications per module

We need a mechanism to allow specification of permissions on a per-module basis.

Requirements:

1. Allow 'grant' list per module
2. Default to 'grant' of AllPermission (??)
3. Prevent module from loading (??) if all permissions are not granted - or perhaps restrict module effective permission set to the intersection of granted and requested permissions