It would be a nice feature for custom roles (ie, those beyond anon and auth) to show greyed-out boxes for all the permissions that the authenticated user has -- in other words, those which it's no point granting to a role.