Default group role assignments are somewhat novel since we don't want to have to add 10s or 100s of thousands of role bindings when a new default Role is added. We need some "RoleSet" abstraction for which there is a default binding, and then we only need to update the RoleSet.