Originally on plugin activation, the plugin reset all permissions to the delivered set of permissions.

An earlier optimisation first checked whether each permission was present or not and then only set it to the default value if it was not present.

Thus if a permission had been removed, reactivation would redefine the permission.

If the presence of read_documents is first checked for the role, and if present then to skip the permission setting for the role, then assume the the permissions are as the user requires and to not reset them for the role.

Note that the default permission of read_documents is true for all roles.

This does imply that the user does need to set the read_documents permission to false if the role is not to read_documents rather than removing it.