We've created some roles on production and allowed various permissions for those roles. This needs to be done by an automatic migration so our testing instances reflect reality.
Once we go down this path, we'll have to maintain permissions with ongoing migrations as they change further.