RBAC that can't drift

When navigation and route guards are written separately, they disagree. Derive both from one permission map and the disagreement becomes impossible.