diff --git a/common/proto/auth.proto b/common/proto/auth.proto
index a8080867..1d8bc78d 100644
--- a/common/proto/auth.proto
+++ b/common/proto/auth.proto
@@ -9,6 +9,9 @@ service AuthService {
   rpc Login(LoginRequest) returns (LoginResponse);
   rpc GetAuthorization(GetAuthorizationRequest) returns (AuthorizationSnapshot);
   rpc SetTimezone(SetTimezoneRequest) returns (UserPreferences);
+  rpc ListRoles(ListRolesRequest) returns (ListRolesResponse);
+  rpc AddRole(AddRoleRequest) returns (Role);
+  rpc RemoveRole(RemoveRoleRequest) returns (Role);
 }
 
 message RegisterRequest {
@@ -64,3 +67,22 @@ message AuthorizationSnapshot {
   string role = 1;
   repeated Permission permissions = 2;
 }
+
+message Role {
+  string name = 1;
+  bool built_in = 2;
+}
+
+message ListRolesRequest {}
+
+message ListRolesResponse {
+  repeated Role roles = 1;
+}
+
+message AddRoleRequest {
+  string name = 1;
+}
+
+message RemoveRoleRequest {
+  string name = 1;
+}
diff --git a/common/src/proto/descriptor.bin b/common/src/proto/descriptor.bin
index 0077d896..0bd23bba 100644
Binary files a/common/src/proto/descriptor.bin and b/common/src/proto/descriptor.bin differ
diff --git a/common/src/proto/komp_ac.auth.rs b/common/src/proto/komp_ac.auth.rs
index 856e77a3..2fa7cf86 100644
--- a/common/src/proto/komp_ac.auth.rs
+++ b/common/src/proto/komp_ac.auth.rs
@@ -94,6 +94,30 @@ pub struct AuthorizationSnapshot {
     #[prost(message, repeated, tag = "2")]
     pub permissions: ::prost::alloc::vec::Vec<Permission>,
 }
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct Role {
+    #[prost(string, tag = "1")]
+    pub name: ::prost::alloc::string::String,
+    #[prost(bool, tag = "2")]
+    pub built_in: bool,
+}
+#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct ListRolesRequest {}
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ListRolesResponse {
+    #[prost(message, repeated, tag = "1")]
+    pub roles: ::prost::alloc::vec::Vec<Role>,
+}
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct AddRoleRequest {
+    #[prost(string, tag = "1")]
+    pub name: ::prost::alloc::string::String,
+}
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct RemoveRoleRequest {
+    #[prost(string, tag = "1")]
+    pub name: ::prost::alloc::string::String,
+}
 /// Generated client implementations.
 pub mod auth_service_client {
     #![allow(
@@ -275,6 +299,72 @@ pub mod auth_service_client {
                 .insert(GrpcMethod::new("komp_ac.auth.AuthService", "SetTimezone"));
             self.inner.unary(req, path, codec).await
         }
+        pub async fn list_roles(
+            &mut self,
+            request: impl tonic::IntoRequest<super::ListRolesRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::ListRolesResponse>,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::unknown(
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic_prost::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/komp_ac.auth.AuthService/ListRoles",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("komp_ac.auth.AuthService", "ListRoles"));
+            self.inner.unary(req, path, codec).await
+        }
+        pub async fn add_role(
+            &mut self,
+            request: impl tonic::IntoRequest<super::AddRoleRequest>,
+        ) -> std::result::Result<tonic::Response<super::Role>, tonic::Status> {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::unknown(
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic_prost::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/komp_ac.auth.AuthService/AddRole",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("komp_ac.auth.AuthService", "AddRole"));
+            self.inner.unary(req, path, codec).await
+        }
+        pub async fn remove_role(
+            &mut self,
+            request: impl tonic::IntoRequest<super::RemoveRoleRequest>,
+        ) -> std::result::Result<tonic::Response<super::Role>, tonic::Status> {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::unknown(
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic_prost::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/komp_ac.auth.AuthService/RemoveRole",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("komp_ac.auth.AuthService", "RemoveRole"));
+            self.inner.unary(req, path, codec).await
+        }
     }
 }
 /// Generated server implementations.
@@ -309,6 +399,21 @@ pub mod auth_service_server {
             &self,
             request: tonic::Request<super::SetTimezoneRequest>,
         ) -> std::result::Result<tonic::Response<super::UserPreferences>, tonic::Status>;
+        async fn list_roles(
+            &self,
+            request: tonic::Request<super::ListRolesRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::ListRolesResponse>,
+            tonic::Status,
+        >;
+        async fn add_role(
+            &self,
+            request: tonic::Request<super::AddRoleRequest>,
+        ) -> std::result::Result<tonic::Response<super::Role>, tonic::Status>;
+        async fn remove_role(
+            &self,
+            request: tonic::Request<super::RemoveRoleRequest>,
+        ) -> std::result::Result<tonic::Response<super::Role>, tonic::Status>;
     }
     #[derive(Debug)]
     pub struct AuthServiceServer<T> {
@@ -564,6 +669,141 @@ pub mod auth_service_server {
                     };
                     Box::pin(fut)
                 }
+                "/komp_ac.auth.AuthService/ListRoles" => {
+                    #[allow(non_camel_case_types)]
+                    struct ListRolesSvc<T: AuthService>(pub Arc<T>);
+                    impl<
+                        T: AuthService,
+                    > tonic::server::UnaryService<super::ListRolesRequest>
+                    for ListRolesSvc<T> {
+                        type Response = super::ListRolesResponse;
+                        type Future = BoxFuture<
+                            tonic::Response<Self::Response>,
+                            tonic::Status,
+                        >;
+                        fn call(
+                            &mut self,
+                            request: tonic::Request<super::ListRolesRequest>,
+                        ) -> Self::Future {
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as AuthService>::list_roles(&inner, request).await
+                            };
+                            Box::pin(fut)
+                        }
+                    }
+                    let accept_compression_encodings = self.accept_compression_encodings;
+                    let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
+                    let inner = self.inner.clone();
+                    let fut = async move {
+                        let method = ListRolesSvc(inner);
+                        let codec = tonic_prost::ProstCodec::default();
+                        let mut grpc = tonic::server::Grpc::new(codec)
+                            .apply_compression_config(
+                                accept_compression_encodings,
+                                send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
+                            );
+                        let res = grpc.unary(method, req).await;
+                        Ok(res)
+                    };
+                    Box::pin(fut)
+                }
+                "/komp_ac.auth.AuthService/AddRole" => {
+                    #[allow(non_camel_case_types)]
+                    struct AddRoleSvc<T: AuthService>(pub Arc<T>);
+                    impl<
+                        T: AuthService,
+                    > tonic::server::UnaryService<super::AddRoleRequest>
+                    for AddRoleSvc<T> {
+                        type Response = super::Role;
+                        type Future = BoxFuture<
+                            tonic::Response<Self::Response>,
+                            tonic::Status,
+                        >;
+                        fn call(
+                            &mut self,
+                            request: tonic::Request<super::AddRoleRequest>,
+                        ) -> Self::Future {
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as AuthService>::add_role(&inner, request).await
+                            };
+                            Box::pin(fut)
+                        }
+                    }
+                    let accept_compression_encodings = self.accept_compression_encodings;
+                    let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
+                    let inner = self.inner.clone();
+                    let fut = async move {
+                        let method = AddRoleSvc(inner);
+                        let codec = tonic_prost::ProstCodec::default();
+                        let mut grpc = tonic::server::Grpc::new(codec)
+                            .apply_compression_config(
+                                accept_compression_encodings,
+                                send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
+                            );
+                        let res = grpc.unary(method, req).await;
+                        Ok(res)
+                    };
+                    Box::pin(fut)
+                }
+                "/komp_ac.auth.AuthService/RemoveRole" => {
+                    #[allow(non_camel_case_types)]
+                    struct RemoveRoleSvc<T: AuthService>(pub Arc<T>);
+                    impl<
+                        T: AuthService,
+                    > tonic::server::UnaryService<super::RemoveRoleRequest>
+                    for RemoveRoleSvc<T> {
+                        type Response = super::Role;
+                        type Future = BoxFuture<
+                            tonic::Response<Self::Response>,
+                            tonic::Status,
+                        >;
+                        fn call(
+                            &mut self,
+                            request: tonic::Request<super::RemoveRoleRequest>,
+                        ) -> Self::Future {
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as AuthService>::remove_role(&inner, request).await
+                            };
+                            Box::pin(fut)
+                        }
+                    }
+                    let accept_compression_encodings = self.accept_compression_encodings;
+                    let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
+                    let inner = self.inner.clone();
+                    let fut = async move {
+                        let method = RemoveRoleSvc(inner);
+                        let codec = tonic_prost::ProstCodec::default();
+                        let mut grpc = tonic::server::Grpc::new(codec)
+                            .apply_compression_config(
+                                accept_compression_encodings,
+                                send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
+                            );
+                        let res = grpc.unary(method, req).await;
+                        Ok(res)
+                    };
+                    Box::pin(fut)
+                }
                 _ => {
                     Box::pin(async move {
                         let mut response = http::Response::new(
diff --git a/server b/server
index 65e67fe7..5fa954d3 160000
--- a/server
+++ b/server
@@ -1 +1 @@
-Subproject commit 65e67fe785b76a647759ca7d7e3517d251dab235
+Subproject commit 5fa954d3f45230069c2ca3fa169f014a689cac84