I can see the value of this. It's the reverse of most of the Auth/Authz modules on CPAN, which actually perform authentication against a pre-existing store. Having something to manage that data seems like a useful thing to have.

Some quick notes:

• I noticed Authen::Users, which seems like the only existing attempt at this
• I'd separate Authentication and Authorization if I were you (think /etc/passwd and /etc/group)
• I wouldn't bother with performing authentication; Authen::Simple is a nice API for that, and there are hundreds of other modules and frameworks that already provide that service. Restrict yourself to managing the auth data, because that seems to be the one thing that's still missing on CPAN

At first, I had some reservations against must(), and can(), but if you do drop performing auth, then those would be moot :) If you do want to implement it, I'd suggest must_have_role() and has_role() (or maybe may() or something like that, but can() is already used for OO purposes, and carries too much of that meaning).

Bottom line: I'd like to see a nice framework for user and role data management. I don't know if it'll be easy for you to make it such that it can target PAM, SASL, Kerberos, Active Directory etc., but I bet there's demand for such a beast.

Update: I rummaged around CPAN some more, and found Aut. Seems fairly similar to your scope. There's also Tree::Authz, which looks fairly comprehensive as well. If you haven't done so yet (but I bet you have), I recommend searching CPAN for "authentication" and/or "authorization". There's a lot to wade through, but that'll give you a good idea what's out there, and what's still missing.