Build the standard Permission::Struct set covering file, config, storage, system, and admin categories. Sensitive permissions (config.update, system.*, admin.*, role.manage) are flagged so audit logging picks them up.
Permission::Struct
config.update
system.*
admin.*
role.manage