Currently the roles in Spring Surf are hardcoded in the class:

org.springframework.extensions.webscripts.Description

and are limited to: admin, user, guest, none.

It would be useful to have this list of roles be customisable, or at least extendable, possibly via a custom class or via list defined in the spring configuration files?

In our use case we have a special role in between admin and user, where this 'readonly-admin' can view the admin settings, but does not have the permissions to modify these values. The are potentially other use cases for this.