Security Resources Defining, Static/Dynamic

I am implementing a simple(hopefully) security manager within an application. Is it better to have predefined(static) roles, custom roles(dynamic)? I am leaning more towards dynamic groups or roles only because then it would not require a redeploy to update the system. Also, 开发者_高级运维what would be the best approach to define resources in general? The application has a database that can hold either the static or dynamic values.