If you combine the above with site.yml files on a per role basis (you can do that in a plugin), you can achieve what you need.
site.yml