Identity is where your application tracks the Security Identity (a user, etc) that is accessing/leasing/locking a namespace element.

Permission implements access control over a given PathElement and possible all of its descendents.

Role is where your application tracks what capability a given identity is using to access/lease/lock a namespace resource.

RoleUsageHookFunc declares a function provided by your code which will be called (as a separate goroutine) when a declared role is used to grant access to a Namespace Path Element.