Assert a role is, or is not, granted a permission, as the role's permissions form (/admin/people/permissions/<role>) shows it: the permission's checkbox is ticked. The role is named by its label or its machine name; the permission by its machine name ("create article content") or by its title on the form ("Article: Create new content"). No command line is involved, so the check runs against any site the suite can log in to.
It reports what the role itself is granted. A permission of the "Authenticated user" role applies to every account that is logged in, without being ticked for the other roles.
Examples
Then the "Content editor" role should have the "access content overview" permission
And the "content_editor" role should have the "access administration pages" permission
Then the "Anonymous user" role should not have the "administer nodes" permission
And the "Authenticated user" role should have the "View published content" permission
Then the "Content editor" role should not have the "administer users" permission
Pattern
Then(/^the "([^"]*)" role should( not)* have the "([^"]*)" permission$/, …)
Part of @webship-js/drupal-core-steps (github.com/webship/drupal-core-steps), a step pack for Webship-js 2.0.x.