"Does Write include Read"...
This question can be divided into two parts.
Your stakeholders need to decide the externally visible privileges from the domain and business perspective. These are the privileges that your customers will see, and those that your support staff will speak with customers about. These are domain and business decisions, not programmer decisions.
(The business may choose that Write implies also Read -- though there are valid cases where that isn't necessarily true).
The programmers implementing the system need to decide the granularity of the privileges they want to see and test against within the code. This may very well separate out Read from Write even if the business chooses that regarding the externally articulated privileges Write includes Read.
What we want to do is cleanly map the business notion of privilege to the internal representation, in particular, so that this is DRY (occurs in only one place in the source code). This so we don't bake in assumption that Write includes Read in various places scattered within the implementation.