Your role based approach would be the more general solution.

What's wrong here is that you forgot to add the created RolePermissionTypes to the RolePermissionTypeCollection in the addPredefinedRolePermissions method.