Consistent naming
wfh.screenshots.view, core.users.block, wfh.reports.download — the pattern makes every permission's scope obvious at a glance.
Core capability
Module-registered
Each pluggable module registers its own permission set from its own service provider — core code never needs to know a module exists by name.
Matrix picker UI
A tree/matrix permission picker groups permissions by module and submodule when assigning a role — not a flat, unlabeled checkbox list.
Reports are gated too
Every PDF/Excel export is permission-gated — root_admin always can, everyone else only when explicitly granted.