The idea here is that you have roles "LibraryAdmin", "CircDesk", "Cataloguing", etc. We would probably attach the roles to patron categories (ie groups) and patrons. Separately we'd have an attribute-based policy. Typically, you have a "subject" (ie Logged in user), "action" (RunReport), and "object" (Report 42). Sometimes you'll also have a "condition"/"context" (LoggedInBranch CPL). This attribute-based policy could then be assigned to a role or a patron. I expect broad policies would be applied at the role level, and then more specific policies would be applied at the patron level. We might find that we rarely or never use them at the patron-level, but probably good to allow for that level of specificity.
In the past, we've talked about replacing the current authorization/access control system all at once, but I think that this could be implemented in an incremental way. I think we'd want to consider a broad scope of actions to make sure we're designing it in a way that does accommodate the whole of Koha, but we could just do it a little bit at a time.