As of right now, if no permissions are set, the flood gates are kind of left open to the public to do whatever they would like to. This could lead to issues in the future where a developer may add a table and forget to define empty permissions. It would be much safer to simply disable permissions by default and only allow users to access and mutate data if permissions are defined for that role.