Default group role assignments are somewhat novel since we don't want to have to add 10s or 100s of thousands of role bindings when a new default Role is added. We will use "parent" Roles for each of the default groups. Each parent role will have child roles for each role that is included by the platform for that default group.

The input of this process is what roles are now default or not (from rbac-config), and the output is changes to these default roles via tuples.

more details:

https://docs.google.com/document/d/16Qc4Qr8Vqwu1bQK0Wh-iAsDb98p6AQJI3HU5LMpm8w8/edit#heading=h.1zyz4ll0ypwv