Though I haven't tested it yet, grsecurity 2.0 in CVS should have all the features that are currently in grsecurity, in addition to roles that can be specified on users and groups. I will be implementing role transitions shortly, as well as IP-based roles.
-Brad