The permissions system in PieFed is greatly inspired by Drupal , which I spent too many years building websites with. It even uses the same function call user_access('administer all communities')
to check if the current user can do something.
Users have one or more roles. Each role has a collection of permissions that have been enabled for it. When a user tries to access a page PieFed doesn't check which role they have, it checks if any of their roles have the necessary permission. This is very flexible and extensible - to limit access to an area the admin can either remove the permission from a role OR remove a user from a role. It's simple for developers too - just call user_access() and leave it to the instance admin to decide which roles can access the functionality.