diff --git a/admin/tool/lp/tests/behat/plan_workflow.feature b/admin/tool/lp/tests/behat/plan_workflow.feature
index 29d49196ad6..abb075449a8 100644
--- a/admin/tool/lp/tests/behat/plan_workflow.feature
+++ b/admin/tool/lp/tests/behat/plan_workflow.feature
@@ -15,6 +15,18 @@ Feature: Manage plan workflow
       | usermanageowndraftplan | User manage own draft plan role | user |
       | usermanageownplan | User manage own plan role | user |
       | manageplan | Manager all plans role | manager |
+    And the following "role capabilities" exist:
+      | role                   | moodle/competency:planmanageowndraft |
+      | usermanageowndraftplan | allow                                |
+      | usermanageownplan      | allow                                |
+      | manageplan             | allow                                |
+    And the following "role capabilities" exist:
+      | role              | moodle/competency:planmanageown |
+      | usermanageownplan | allow                           |
+      | manageplan        | allow                           |
+    And the following "role capabilities" exist:
+      | role       | moodle/competency:planmanage | moodle/competency:planview | moodle/competency:planreview | moodle/competency:planrequestreview |
+      | manageplan | allow                        | allow                      | allow                        | allow                               |
     And the following "role assigns" exist:
       | user  | role | contextlevel | reference |
       | user1 | usermanageowndraftplan | System |  |
@@ -40,23 +52,6 @@ Feature: Manage plan workflow
     And the following "blocks" exist:
       | blockname               | contextlevel | reference | pagetypepattern | defaultregion |
       | lp                      | System       | 1         | my-index        | content       |
-    And I log in as "admin"
-    And I set the following system permissions of "User manage own draft plan role" role:
-      | capability | permission |
-      | moodle/competency:planmanageowndraft | Allow |
-    And I set the following system permissions of "User manage own plan role" role:
-      | capability | permission |
-      | moodle/competency:planmanageowndraft | Allow |
-      | moodle/competency:planmanageown | Allow |
-    And I set the following system permissions of "Manager all plans role" role:
-      | capability | permission |
-      | moodle/competency:planmanage | Allow |
-      | moodle/competency:planmanagedraft | Allow |
-      | moodle/competency:planmanageowndraft | Allow |
-      | moodle/competency:planview | Allow |
-      | moodle/competency:planreview | Allow |
-      | moodle/competency:planrequestreview | Allow |
-    And I log out
 
   Scenario: User can manages his own plan draft
     Given I log in as "user1"
diff --git a/admin/tool/monitor/tests/behat/subscription.feature b/admin/tool/monitor/tests/behat/subscription.feature
index 8007fd5cfaa..aee912a3f16 100644
--- a/admin/tool/monitor/tests/behat/subscription.feature
+++ b/admin/tool/monitor/tests/behat/subscription.feature
@@ -169,10 +169,9 @@ Feature: tool_monitor_subscriptions
     And I should not see "You can manage rules the from the Event monitoring rules page."
 
   Scenario: No manage rules link when user does not have permission
-    Given I log in as "admin"
-    And I set the following system permissions of "Non-editing teacher" role:
-      | tool/monitor:managerules | Prohibit |
-    And I log out
+    Given the following "role capability" exists:
+      | role                     | Non-editing teacher |
+      | tool/monitor:managerules | Prohibit            |
     And I log in as "teacher1"
     And I follow "Preferences" in the user menu
     And I follow "Event monitoring"
diff --git a/admin/tool/policy/tests/behat/acceptances.feature b/admin/tool/policy/tests/behat/acceptances.feature
index fd54462c7b8..4826fde89e4 100644
--- a/admin/tool/policy/tests/behat/acceptances.feature
+++ b/admin/tool/policy/tests/behat/acceptances.feature
@@ -48,11 +48,9 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And "Pending" "text" should exist in the "User Two" "table_row"
 
   Scenario: Agree on behalf of another user as a manager, single policy, javascript off
-    Given I log in as "admin"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
-    And I log out
+    Given the following "role capability" exists:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
     When I log in as "manager"
     And I press "Next"
     And I set the field "I agree to the This site policy" to "1"
@@ -73,11 +71,9 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
 
   @javascript
   Scenario: Agree on behalf of another user as a manager, single policy, javascript on
-    Given I log in as "admin"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
-    And I log out
+    Given the following "role capabilities" exist:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
     When I log in as "manager"
     And I press "Next"
     And I set the field "I agree to the This site policy" to "1"
@@ -135,13 +131,13 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And "Pending" "text" should exist in the "This privacy policy" "table_row"
 
   Scenario: Agree on behalf of another user as a manager, multiple policies, javascript off
-    Given I log in as "admin"
+    Given the following "role capability" exists:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
+    And I log in as "admin"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
     And I press "Continue"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
     And I log out
     When I log in as "manager"
     And I press "Next"
@@ -167,14 +163,14 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
 
   @javascript
   Scenario: Agree on behalf of another user as a manager, multiple policies, javascript on
+    Given the following "role capability" exists:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
     Given I log in as "admin"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Actions" "link_or_button" in the "This privacy policy" "table_row"
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
     And I press "Activate"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
     And I log out
     When I log in as "manager"
     And I press "Next"
@@ -215,11 +211,9 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     And I should not see "Policies and agreements"
 
   Scenario: Policies and agreements profile link visible also for users who can access on behalf of others
-    Given I log in as "admin"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
-    And I log out
+    Given the following "role capability" exists:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
     And I log in as "manager"
     And I press "Next"
     And I set the field "I agree to the This site policy" to "1"
@@ -231,11 +225,9 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
     Then I should see "Policies and agreements"
 
   Scenario: Agree on behalf of another user as an admin who is logged in as a manager
-    Given I log in as "admin"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
-    And I log out
+    Given the following "role capability" exists:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
     When I log in as "manager"
     And I press "Next"
     And I set the field "I agree to the This site policy" to "1"
@@ -261,14 +253,14 @@ Feature: Viewing acceptances reports and accepting on behalf of other users
 
   @javascript
   Scenario: Bulk agree on behalf of another users as a manager, multiple policies, javascript on
-    Given I log in as "admin"
+    Given the following "role capability" exists:
+      | role                     | manager |
+      | tool/policy:acceptbehalf | allow   |
+    And I log in as "admin"
     And I navigate to "Users > Privacy and policies > Manage policies" in site administration
     And I click on "Actions" "link_or_button" in the "This privacy policy" "table_row"
     And I click on "Set status to \"Active\"" "link" in the "This privacy policy" "table_row"
     And I press "Activate"
-    And I set the following system permissions of "Manager" role:
-      | capability | permission |
-      | tool/policy:acceptbehalf | Allow |
     And I log out
     When I log in as "manager"
     And I press "Next"
diff --git a/blocks/tests/behat/restrict_available_blocks.feature b/blocks/tests/behat/restrict_available_blocks.feature
index 6ec366113e1..56cd80f65d3 100644
--- a/blocks/tests/behat/restrict_available_blocks.feature
+++ b/blocks/tests/behat/restrict_available_blocks.feature
@@ -24,10 +24,12 @@ Feature: Allowed blocks controls
     And I should see "Course completion status" in the "Course completion status" "block"
 
   Scenario: Blocks can not be added when the admin restricts the permissions
+    Given the following "role capability" exists:
+      | role                               | editingteacher  |
+      | block/activity_modules:addinstance | prohibit        |
     Given I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | block/activity_modules:addinstance | Prohibit |
-    And I am on the "Course 1" "permissions" page
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Permissions" in current page administration
     And I override the system permissions of "Teacher" role with:
       | block/completionstatus:addinstance | Prohibit |
     And I log out
diff --git a/course/format/singleactivity/tests/behat/create_course.feature b/course/format/singleactivity/tests/behat/create_course.feature
index 6eee07ff1cf..abce67e9eca 100644
--- a/course/format/singleactivity/tests/behat/create_course.feature
+++ b/course/format/singleactivity/tests/behat/create_course.feature
@@ -14,19 +14,17 @@ Feature: Courses can be created in Single Activity mode
     And the following "system role assigns" exist:
       | user   | role    | contextlevel |
       | kevin  | creator | System       |
-    And I log in as "admin"
-    And I set the following system permissions of "Creator" role:
-      | capability | permission |
-      | moodle/course:create | Allow |
-      | moodle/course:update | Allow |
-      | moodle/course:manageactivities | Allow |
-      | moodle/course:viewparticipants | Allow |
-      | moodle/role:assign | Allow |
-      | mod/quiz:addinstance | Allow |
-    And I log out
-    And I log in as "kevin"
+    And the following "role capability" exists:
+      | role                           | creator |
+      | moodle/course:create           | allow   |
+      | moodle/course:update           | allow   |
+      | moodle/course:manageactivities | allow   |
+      | moodle/course:viewparticipants | allow   |
+      | moodle/role:assign             | allow   |
+      | mod/quiz:addinstance           | allow   |
+    When I log in as "kevin"
     And I am on site homepage
-    When I press "Add a new course"
+    And I press "Add a new course"
     And I set the following fields to these values:
       | Course full name  | My first course |
       | Course short name | myfirstcourse |
diff --git a/course/tests/behat/course_browsing.feature b/course/tests/behat/course_browsing.feature
index e4bb0c2e716..abacc36535c 100644
--- a/course/tests/behat/course_browsing.feature
+++ b/course/tests/behat/course_browsing.feature
@@ -17,24 +17,20 @@ Feature: Restricting access to course lists
       | English Y1 | ENG1      | ENG |
       | English Y2 | ENG2      | ENG |
       | Humanities Y1 | HUM2   | MISC |
-    Given the following "users" exist:
+    And the following "users" exist:
       | username | firstname | lastname | email |
       | user0 | User | Z | user0@example.com |
       | userb | User | B | userb@example.com |
       | usere | User | E | usere@example.com |
-    Given the following "roles" exist:
+    And the following "roles" exist:
       | name            | shortname    | description      | archetype      |
       | Category viewer | coursebrowse | My custom role 1 |                |
+    And the following "role capabilities" exist:
+        | role         | moodle/category:viewcourselist |
+        | user         | prevent                        |
+        | guest        | prevent                        |
+        | coursebrowse | allow                          |
     Given I log in as "admin"
-    And I set the following system permissions of "Authenticated user" role:
-      | capability | permission |
-      | moodle/category:viewcourselist | Prevent |
-    And I set the following system permissions of "Guest" role:
-      | capability | permission |
-      | moodle/category:viewcourselist | Prevent |
-    And I set the following system permissions of "Category viewer" role:
-      | capability | permission |
-      | moodle/category:viewcourselist | Allow |
     And I am on site homepage
     And I turn editing mode on
     And the following config values are set as admin:
diff --git a/course/tests/behat/course_creation.feature b/course/tests/behat/course_creation.feature
index f38714e9346..8deb2a58b35 100644
--- a/course/tests/behat/course_creation.feature
+++ b/course/tests/behat/course_creation.feature
@@ -75,13 +75,11 @@ Feature: Managers can create courses
     And the following "system role assigns" exist:
       | user   | role    | contextlevel |
       | kevin  | creator | System       |
-    And I log in as "admin"
-    And I set the following system permissions of "Creator" role:
-      | capability | permission |
-      | moodle/course:create | Allow |
-      | moodle/course:manageactivities | Allow |
-      | moodle/course:viewparticipants | Allow |
-    And I log out
+    And the following "role capability" exists:
+      | role                           | creator |
+      | moodle/course:create           | allow   |
+      | moodle/course:manageactivities | allow   |
+      | moodle/course:viewparticipants | allow   |
     And I log in as "kevin"
     And I am on site homepage
     When I press "Add a new course"
diff --git a/course/tests/behat/course_request.feature b/course/tests/behat/course_request.feature
index 89c36c5ae65..8da4d59fdf9 100644
--- a/course/tests/behat/course_request.feature
+++ b/course/tests/behat/course_request.feature
@@ -17,11 +17,9 @@ Feature: Users can request and approve courses
       | user2 | Acceptance test site | manager |
     And the following config values are set as admin:
       | lockrequestcategory | 1 |
-    Given I log in as "admin"
-    And I set the following system permissions of "Authenticated user" role:
-      | capability | permission |
-      | moodle/course:request | Allow |
-    And I log out
+    And the following "role capability" exists:
+      | role                  | user  |
+      | moodle/course:request | allow |
     When I log in as "user1"
     And I am on course index
     And I click on "More actions" "button"
@@ -71,11 +69,9 @@ Feature: Users can request and approve courses
       | user1 | courserequestor | Category     | ENG       |
       | user2 | manager         | Category     | SCI       |
       | user3 | manager         | Category     | ENG       |
-    Given I log in as "admin"
-    And I set the following system permissions of "Course requestor" role:
-      | capability            | permission |
-      | moodle/course:request | Allow      |
-    And I log out
+    And the following "role capability" exists:
+      | role                  | courserequestor |
+      | moodle/course:request | allow           |
     And I log in as "user1"
     And I am on course index
     And I follow "English category"
diff --git a/course/tests/behat/coursetags.feature b/course/tests/behat/coursetags.feature
index fa29d31e985..a681f0d5fc0 100644
--- a/course/tests/behat/coursetags.feature
+++ b/course/tests/behat/coursetags.feature
@@ -68,10 +68,9 @@ Feature: Tagging courses
     And I log out
 
   Scenario: User can set course tags using separate form
-    Given I log in as "admin"
-    And I set the following system permissions of "Non-editing teacher" role:
-      | moodle/course:tag | Allow |
-    And I log out
+    Given the following "role capability" exists:
+      | role              | Non-editing teacher |
+      | moodle/course:tag | Allow               |
     When I log in as "teacher2"
     And I am on "Course 1" course homepage
     And I navigate to "Course tags" in current page administration
diff --git a/course/tests/behat/navigate_course_list.feature b/course/tests/behat/navigate_course_list.feature
index 451360bd15a..3e8a94e0a39 100644
--- a/course/tests/behat/navigate_course_list.feature
+++ b/course/tests/behat/navigate_course_list.feature
@@ -62,11 +62,9 @@ Feature: Browse course list and return back from enrolment page
     And the following "activities" exist:
       | activity   | name        | intro                         | course | idnumber    |
       | choice     | Test choice | Test choice description       | C1     | choice1     |
-    And I log in as "admin"
-    And I set the following system permissions of "Non-enrolled" role:
-      | capability | permission |
-      | moodle/course:view | Allow |
-    And I log out
+    And the following "role capability" exists:
+      | role               | custom1 |
+      | moodle/course:view | allow   |
     When I log in as "user1"
     And I am on course index
     And I follow "Category 1"
diff --git a/course/tests/behat/restrict_available_activities.feature b/course/tests/behat/restrict_available_activities.feature
index 50a5439925b..17fd30f729f 100644
--- a/course/tests/behat/restrict_available_activities.feature
+++ b/course/tests/behat/restrict_available_activities.feature
@@ -31,9 +31,11 @@ Feature: Restrict activities availability
   @javascript @skip_chrome_zerosize
   Scenario: Activities can not be added when the admin restricts the permissions
     Given I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | mod/chat:addinstance | Prohibit |
-    And I am on the "Course 1" "permissions" page
+    And the following "role capability" exists:
+      | role                 | editingteacher  |
+      | mod/chat:addinstance | prohibit        |
+    And I am on "Course 1" course homepage
+    And I navigate to "Users > Permissions" in current page administration
     And I override the system permissions of "Teacher" role with:
       | mod/glossary:addinstance | Prohibit |
     And I log out
diff --git a/course/tests/behat/role_renaming.feature b/course/tests/behat/role_renaming.feature
index b650a347d84..a19a7328023 100644
--- a/course/tests/behat/role_renaming.feature
+++ b/course/tests/behat/role_renaming.feature
@@ -39,11 +39,9 @@ Feature: Rename roles in a course
     And I should not see "Learner (Student)" in the "Student 1" "table_row"
 
   Scenario: Ability to rename roles can be prevented
-    Given I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability         | permission |
-      | moodle/course:renameroles | Inherit |
-    And I follow "Log out"
+    Given the following "role capability" exists:
+      | role                      | editingteacher |
+      | moodle/course:renameroles | inherit |
     When I log in as "teacher1"
     And I am on "Course 1" course homepage
     And I navigate to "Settings" in current page administration
diff --git a/grade/report/grader/tests/behat/switch_views.feature b/grade/report/grader/tests/behat/switch_views.feature
index df7912bb8d6..319f6a7ef26 100644
--- a/grade/report/grader/tests/behat/switch_views.feature
+++ b/grade/report/grader/tests/behat/switch_views.feature
@@ -71,19 +71,15 @@ Feature: We can change what we are viewing on the grader report
 
   @javascript @skip_chrome_zerosize
   Scenario: Minimise the grader report containing hidden activities without the 'moodle/grade:viewhidden' capability
+    Given the following "role capability" exists:
+      | role                    | Teacher |
+      | moodle/grade:viewhidden | Prevent |
     When I am on "Course 1" course homepage with editing mode on
     And I open "Test assignment name 2" actions menu
     And I click on "Hide" "link" in the "Test assignment name 2" activity
-    And I log out
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability | permission |
-      | moodle/grade:viewhidden | Prevent |
-    And I log out
-    And I log in as "teacher1"
     And I am on "Course 1" course homepage
     And I navigate to "View > Grader report" in the course gradebook
-    And I should see "Test assignment name 1" in the "user-grades" "table"
+    Then I should see "Test assignment name 1" in the "user-grades" "table"
     And I should see "Test assignment name 2" in the "user-grades" "table"
     And I should see "Manual grade"
     And I should see "Course total"
@@ -100,8 +96,8 @@ Feature: We can change what we are viewing on the grader report
       | -1-                | -1-                  | -3-       |
       | Student 1          | student1@example.com | 105.71    |
     And I click on grade item menu "Course 1" of type "course" on "grader" page
-    And I click on "Show grades only" "link"
-    And I should see "Test assignment name 1" in the "user-grades" "table"
+    When I click on "Show grades only" "link"
+    Then I should see "Test assignment name 1" in the "user-grades" "table"
     And I should see "Test assignment name 2" in the "user-grades" "table"
     And I should see "Manual grade"
     And I should not see "Course total"
diff --git a/grade/report/user/tests/behat/user_view.feature b/grade/report/user/tests/behat/user_view.feature
index 87b949f4089..cc9e95aab4b 100644
--- a/grade/report/user/tests/behat/user_view.feature
+++ b/grade/report/user/tests/behat/user_view.feature
@@ -179,12 +179,9 @@ Feature: View the user report as the student will see it
       | Test assignment six     |
 
   Scenario: View the report as the student from both the teachers and students perspective when the student can view hidden
-    Given I log out
-    And I log in as "admin"
-    And I set the following system permissions of "Student" role:
-      | capability | permission |
-      | moodle/grade:viewhidden | Allow |
-    And I log out
+    Given the following "role capability" exists:
+      | role                    | student |
+      | moodle/grade:viewhidden | Allow   |
     And I am on the "C1" "Course" page logged in as "teacher1"
     And I navigate to "Setup > Course grade settings" in the course gradebook
     And I set the field with xpath "//select[@name='report_user_showtotalsifcontainhidden']" to "Show totals excluding hidden items"
diff --git a/group/tests/behat/auto_creation.feature b/group/tests/behat/auto_creation.feature
index ab49a212e74..b1523c5467c 100644
--- a/group/tests/behat/auto_creation.feature
+++ b/group/tests/behat/auto_creation.feature
@@ -164,11 +164,9 @@ Feature: Automatic creation of groups
 
   Scenario: Do not display 'Include only active enrolments' if user does not have the 'moodle/course:viewsuspendedusers' capability
     Given I log out
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability | permission |
-      | moodle/course:viewsuspendedusers | Prevent |
-    And I log out
+    And the following "role capability" exists:
+      | role                             | editingteacher |
+      | moodle/course:viewsuspendedusers | prevent        |
     And I log in as "teacher1"
     And I am on the "Course 1" "groups" page
     When I press "Auto-create groups"
diff --git a/group/tests/behat/create_groups.feature b/group/tests/behat/create_groups.feature
index 359d502c341..c9da9840fad 100644
--- a/group/tests/behat/create_groups.feature
+++ b/group/tests/behat/create_groups.feature
@@ -99,10 +99,9 @@ Feature: Organize students into groups
     And the following "course enrolments" exist:
       | user | course | role |
       | teacher1 | C1 | editingteacher |
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | moodle/course:changeidnumber | Prevent |
-    And I log out
+    And the following "role capability" exists:
+      | role                         | editingteacher |
+      | moodle/course:changeidnumber | prevent        |
     And I log in as "teacher1"
     And I am on the "Course 1" "groups" page
     When I press "Create group"
diff --git a/group/tests/behat/delete_groups.feature b/group/tests/behat/delete_groups.feature
index 19da124b8fe..553b0972b4f 100644
--- a/group/tests/behat/delete_groups.feature
+++ b/group/tests/behat/delete_groups.feature
@@ -58,9 +58,9 @@ Feature: Automatic deletion of groups and groupings
   @javascript @skip_chrome_zerosize
   Scenario: Delete groups and groupings with and without ID numbers without the 'moodle/course:changeidnumber' capability
     Given I log out
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-     | moodle/course:changeidnumber | Prevent |
+    And the following "role capability" exists:
+      | role                         | Teacher |
+      | moodle/course:changeidnumber | Prevent |
     And I log out
     And I log in as "teacher1"
     And I am on the "Course 1" "groups" page
diff --git a/group/tests/behat/update_groups.feature b/group/tests/behat/update_groups.feature
index 878c5baa5b7..d59f912b875 100644
--- a/group/tests/behat/update_groups.feature
+++ b/group/tests/behat/update_groups.feature
@@ -65,10 +65,9 @@ Feature: Automatic updating of groups and groupings
   @javascript @skip_chrome_zerosize
   Scenario: Update groups and groupings with ID numbers without the 'moodle/course:changeidnumber' capability
     Given I log out
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
+    And the following "role capability" exists:
+      | role                         | Teacher |
       | moodle/course:changeidnumber | Prevent |
-    And I log out
     And I log in as "teacher1"
     And I am on the "Course 1" "groups" page
     And I set the field "groups" to "Group (with ID)"
diff --git a/mod/assign/tests/behat/bulk_remove_submissions.feature b/mod/assign/tests/behat/bulk_remove_submissions.feature
index 98e789a4c5b..30ef6813b55 100644
--- a/mod/assign/tests/behat/bulk_remove_submissions.feature
+++ b/mod/assign/tests/behat/bulk_remove_submissions.feature
@@ -35,12 +35,9 @@ Feature: Bulk remove submissions
       | assign                | user      | onlinetext                   |
       | Test assignment name  | student1  | I'm the student1 submission  |
       | Test assignment name  | student2  | I'm the student2 submission  |
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability                     | permission |
-      | mod/assign:editothersubmission | Allow      |
-    And I log out
-
+    And the following "role capability" exists:
+      | role                           | Teacher |
+      | mod/assign:editothersubmission | Allow   |
     And I am on the "Test assignment name" Activity page logged in as teacher1
     And I follow "View all submissions"
     And I should see "I'm the student1 submission"
@@ -96,13 +93,30 @@ Feature: Bulk remove submissions
       | assign                | user      | onlinetext                   |
       | Test assignment name  | student1  | I'm the student1 submission  |
       | Test assignment name  | student2  | I'm the student2 submission  |
+    And the following "role capability" exists:
+      | role                           | Teacher |
+      | mod/assign:editothersubmission | Allow   |
+    And I am on the "Test assignment name" Activity page logged in as teacher1
+    And I follow "View all submissions"
 
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability                     | permission |
-      | mod/assign:editothersubmission | Allow      |
-    And I log out
-
+  @javascript
+  Scenario: Notification should be displayed when non-group users are selected for submission bulk removal
+            in separate group mode
+    Given the following "activity" exists:
+      | activity                            | assign                  |
+      | course                              | C1                      |
+      | name                                | Test assignment name    |
+      | assignsubmission_onlinetext_enabled | 1                       |
+      | assignsubmission_file_enabled       | 0                       |
+      | groupmode                           | 1                       |
+      | submissiondrafts                    | 0                       |
+    And the following "mod_assign > submissions" exist:
+      | assign                | user      | onlinetext                   |
+      | Test assignment name  | student1  | I'm the student1 submission  |
+      | Test assignment name  | student2  | I'm the student2 submission  |
+    Given the following "role capability" exists:
+      | role                           | Teacher |
+      | mod/assign:editothersubmission | Allow   |
     And I am on the "Test assignment name" Activity page logged in as teacher1
     And I follow "View all submissions"
     And I should see "I'm the student1 submission"
@@ -135,11 +149,9 @@ Feature: Bulk remove submissions
       | assign                | user      | onlinetext                   |
       | Test assignment name  | student1  | I'm the student1 submission  |
       | Test assignment name  | student2  | I'm the student2 submission  |
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability                     | permission |
-      | mod/assign:editothersubmission | Allow      |
-    And I log out
+    And the following "role capability" exists:
+      | role                           | Teacher |
+      | mod/assign:editothersubmission | Allow   |
 
     And I am on the "Test assignment name" Activity page logged in as teacher1
     And I follow "View all submissions"
diff --git a/mod/assign/tests/behat/remove_submission.feature b/mod/assign/tests/behat/remove_submission.feature
index aade1877a97..1e8ae35d148 100644
--- a/mod/assign/tests/behat/remove_submission.feature
+++ b/mod/assign/tests/behat/remove_submission.feature
@@ -5,13 +5,11 @@ Feature: Remove a submission
   I need to remove a student submission at any time
 
   Background:
-    Given I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability                     | permission |
-      | mod/assign:editothersubmission | Allow      |
+    Given the following "role capability" exists:
+      | role                           | Teacher |
+      | mod/assign:editothersubmission | Allow   |
     And I set the following administration settings values:
       | Enable timed assignments | 1 |
-    And I log out
     And the following "courses" exist:
       | fullname | shortname | category | groupmode |
       | Course 1 | C1 | 0 | 0 |
diff --git a/mod/feedback/tests/behat/anonymous.feature b/mod/feedback/tests/behat/anonymous.feature
index 228b15bec80..5b1dae6ba51 100644
--- a/mod/feedback/tests/behat/anonymous.feature
+++ b/mod/feedback/tests/behat/anonymous.feature
@@ -58,11 +58,9 @@ Feature: Anonymous feedback
 
   @javascript
   Scenario: Complete anonymous feedback and view analysis on the front page as an authenticated user
-    And I log in as "admin"
-    And I set the following system permissions of "Authenticated user on site home" role:
-      | capability                   | permission |
-      | mod/feedback:viewanalysepage | Allow      |
-    And I log out
+    Given the following "role capability" exists:
+      | role                         | Authenticated user on frontpage |
+      | mod/feedback:viewanalysepage | Allow                           |
     And I log in as "user1"
     And I am on site homepage
     When I follow "Site feedback"
@@ -118,11 +116,9 @@ Feature: Anonymous feedback
   Scenario: Complete fully anonymous feedback and view analyze on the front page as a guest
     Given the following config values are set as admin:
       | feedback_allowfullanonymous | 1 |
-    And I log in as "admin"
-    And I set the following system permissions of "Guest" role:
-      | capability                   | permission |
-      | mod/feedback:viewanalysepage | Allow      |
-    And I log out
+    And the following "role capability" exists:
+      | role                         | Guest |
+      | mod/feedback:viewanalysepage | Allow |
     When I follow "Site feedback"
     And I should not see "Preview questions"
     And I follow "Answer the questions"
diff --git a/mod/feedback/tests/behat/non_anonymous.feature b/mod/feedback/tests/behat/non_anonymous.feature
index 0e329babc10..30862a87b04 100644
--- a/mod/feedback/tests/behat/non_anonymous.feature
+++ b/mod/feedback/tests/behat/non_anonymous.feature
@@ -54,11 +54,9 @@ Feature: Non anonymous feedback
 
   @javascript
   Scenario: Complete non anonymous feedback and view analysis on the front page as an authenticated user
-    And I log in as "admin"
-    And I set the following system permissions of "Authenticated user on site home" role:
-      | capability                   | permission |
-      | mod/feedback:viewanalysepage | Allow      |
-    And I log out
+    Given the following "role capability" exists:
+      | role                         | Authenticated user on frontpage |
+      | mod/feedback:viewanalysepage | Allow                           |
     When I am on the "Site feedback" "feedback activity" page logged in as user1
     And I follow "Answer the questions"
     And I should see "Do you like our site?"
diff --git a/mod/forum/tests/behat/separate_group_discussions.feature b/mod/forum/tests/behat/separate_group_discussions.feature
index 4762a1f9f49..1bc84f8bba0 100644
--- a/mod/forum/tests/behat/separate_group_discussions.feature
+++ b/mod/forum/tests/behat/separate_group_discussions.feature
@@ -266,10 +266,6 @@ Feature: Posting to all groups in a separate group discussion is restricted to u
     And I should not see "Student -> A"
 
   Scenario: Teacher in all groups but without accessallgroups can only post in their groups
-    And I log in as "admin"
-    And I set the following system permissions of "Non-editing teacher" role:
-      | moodle/site:accessallgroups | Prohibit |
-    And I log out
     Given I log in as "noneditor1"
     And I am on "Course 1" course homepage
     And I follow "Standard forum name"
@@ -281,10 +277,6 @@ Feature: Posting to all groups in a separate group discussion is restricted to u
     And I should see "Post a copy to all groups"
 
   Scenario: Teacher in some groups and without accessallgroups can only post in their groups
-    And I log in as "admin"
-    And I set the following system permissions of "Non-editing teacher" role:
-      | moodle/site:accessallgroups | Prohibit |
-    And I log out
     Given I log in as "noneditor1"
     And I am on "Course 1" course homepage
     And I follow "Standard forum name"
diff --git a/mod/lesson/tests/behat/link_to_gradebook.feature b/mod/lesson/tests/behat/link_to_gradebook.feature
index 6f581479c3f..6315265a45a 100644
--- a/mod/lesson/tests/behat/link_to_gradebook.feature
+++ b/mod/lesson/tests/behat/link_to_gradebook.feature
@@ -82,10 +82,9 @@ Feature: link to gradebook on the end of lesson page
     And I should not see "View grades"
 
   Scenario: No link to gradebook if no gradereport/user:view capability
-    Given I log in as "admin"
-    And I set the following system permissions of "Student" role:
-      | capability | permission |
-      | gradereport/user:view | Prevent |
+    Given the following "role capability" exists:
+      | role                  | student |
+      | gradereport/user:view | prevent |
     When I am on the "Test lesson" "lesson activity" page logged in as student1
     And I press "Next page"
     And I press "Next page"
diff --git a/my/tests/behat/reset_all_pages.feature b/my/tests/behat/reset_all_pages.feature
index 9b909857b95..a321ac039f2 100644
--- a/my/tests/behat/reset_all_pages.feature
+++ b/my/tests/behat/reset_all_pages.feature
@@ -10,11 +10,10 @@ Feature: Reset all personalised pages to default
       | student1 | Student | 1 | student1@example.com |
       | student2 | Student | 2 | student2@example.com |
       | student3 | Student | 3 | student3@example.com |
-    And I log in as "admin"
-    And I set the following system permissions of "Authenticated user" role:
-      | block/myprofile:addinstance | Allow |
-      | moodle/block:edit | Allow |
-    And I log out
+    And the following "role capability" exists:
+      | role                        | user  |
+      | moodle/block:edit           | allow |
+      | block/myprofile:addinstance | allow |
 
     And I log in as "student1"
     And I follow "Dashboard"
diff --git a/my/tests/behat/restrict_available_blocks.feature b/my/tests/behat/restrict_available_blocks.feature
index d4f161e1f49..2d879390d51 100644
--- a/my/tests/behat/restrict_available_blocks.feature
+++ b/my/tests/behat/restrict_available_blocks.feature
@@ -24,13 +24,12 @@ Feature: Restrict which blocks can be added to Dashboard
     And the add block selector should contain "Tags" block
 
   Scenario: Remove the ability to add the comments block to Dashboard
-    When I log in as "admin"
-    And I set the following system permissions of "Authenticated user" role:
-      | block/comments:myaddinstance | Prohibit |
-      | block/course_list:myaddinstance | Prohibit |
-      | block/html:myaddinstance | Prohibit |
-    And I log out
-    And I log in as "student1"
+    Given the following "role capability" exists:
+      | role                            | user     |
+      | block/comments:myaddinstance    | prohibit |
+      | block/course_list:myaddinstance | prohibit |
+      | block/html:myaddinstance        | prohibit |
+    When I log in as "student1"
     And I turn editing mode on
     Then the add block selector should not contain "Comments" block
     And the add block selector should not contain "Courses" block
diff --git a/tag/tests/behat/edit_tag.feature b/tag/tests/behat/edit_tag.feature
index 791ce537b8f..f78876a6fec 100644
--- a/tag/tests/behat/edit_tag.feature
+++ b/tag/tests/behat/edit_tag.feature
@@ -23,9 +23,8 @@ Feature: Users can edit tags to add description or rename
 
   @javascript
   Scenario: User with tag editing capability can change tag description
-    Given I log in as "admin"
-    And I set the following system permissions of "Tag editor" role:
-      | capability                   | permission |
+    Given the following "role capability" exists:
+      | role                         | Tag editor |
       | moodle/tag:edit              | Allow      |
       | moodle/site:viewparticipants | Allow      |
       | moodle/user:viewdetails      | Allow      |
diff --git a/tag/tests/behat/flag_tags.feature b/tag/tests/behat/flag_tags.feature
index b71e6364892..2f2c5859d2e 100644
--- a/tag/tests/behat/flag_tags.feature
+++ b/tag/tests/behat/flag_tags.feature
@@ -17,12 +17,10 @@ Feature: Users can flag tags and manager can reset flags
     And the following "tags" exist:
       | name         | isstandard |
       | Neverusedtag | 1          |
-    And I log in as "admin"
-    And I set the following system permissions of "Authenticated user" role:
-      | capability                   | permission |
-      | moodle/site:viewparticipants | Allow      |
-      | moodle/user:viewdetails      | Allow      |
-    And I log out
+    And the following "role capability" exists:
+      | role                         | Authenticated user |
+      | moodle/site:viewparticipants | Allow              |
+      | moodle/user:viewdetails      | Allow              |
     And I log in as "user2"
     And I turn editing mode on
     And the following config values are set as admin:
diff --git a/user/tests/behat/enrol_cohort_list.feature b/user/tests/behat/enrol_cohort_list.feature
index fe32af431f6..46e02159ea3 100644
--- a/user/tests/behat/enrol_cohort_list.feature
+++ b/user/tests/behat/enrol_cohort_list.feature
@@ -21,9 +21,8 @@ Feature: Viewing the list of cohorts to enrol in a course
       | name        | Test cohort name        |
       | idnumber    | 1337                    |
       | description | Test cohort description |
-    And I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
-      | capability           | permission |
+    And the following "role capability" exists:
+      | role                 | Teacher  |
       | moodle/cohort:manage | Prohibit |
       | moodle/cohort:view   | Prohibit |
     And I log out
diff --git a/user/tests/behat/filter_participants.feature b/user/tests/behat/filter_participants.feature
index 4980eaa792f..5c253946473 100644
--- a/user/tests/behat/filter_participants.feature
+++ b/user/tests/behat/filter_participants.feature
@@ -732,9 +732,10 @@ Feature: Course participants can be filtered
 
   @javascript @skip_chrome_zerosize
   Scenario: Filter by user identity fields when cannot see the field data
-    Given I log in as "admin"
-    And I set the following system permissions of "Teacher" role:
+    Given the following "role capability" exists:
+      | role                         | Teacher |
       | moodle/site:viewuseridentity | Prevent |
+    And I log in as "admin"
     And the following config values are set as admin:
       | showuseridentity | idnumber,email,city,country |
     And I log out
diff --git a/user/tests/behat/view_full_profile.feature b/user/tests/behat/view_full_profile.feature
index 75e6220d096..909cd7d3db4 100644
--- a/user/tests/behat/view_full_profile.feature
+++ b/user/tests/behat/view_full_profile.feature
@@ -57,10 +57,9 @@ Feature: Access to full profiles of users
     Then I should see "First access to site"
 
   Scenario: Viewing full profiles with global permission
-    Given I log in as "admin"
-    And I set the following system permissions of "Authenticated user" role:
-      | moodle/user:viewdetails | Allow |
-    And I log out
+    Given the following "role capability" exists:
+      | role                    | user  |
+      | moodle/user:viewdetails | allow |
     When I log in as "student1"
     And I am on "Course 1" course homepage
     And I navigate to course participants