This was causing problems with basic_privs moderator access because it was trying to re-grant all privs again. For now, players can work around it by using a /revoke all before assigning a role intended to be exclusive.
Define roles as sets of privs that can be granted/revoked as a group. Special keywords to make it easier to rebuild a user's priv set from scratch.