So you're looking for a way to carry either a role name, or a list of permitted actions inside a TLS client certificate. I can see why you want to do that: so everything is self-contained in the cert and specified at cert issuance time, so authorization can be enforced, even for example by offline components that have no database access. Neat idea!
This is the kind of thing that X.509v3 Extensions are made for. Unfortunately, none of the extensions defined in RFC 5280 4.2.1. Standard Extensions do what you want.
I did a bit a searching; I'm not aware of other RFCs defining an authorization extension. The Microsoft CA X.509v3 Extensions page also doesn't give anything useful. The openssl extensions page also doesn't an authorization extension, but openssl seems to have a mechanism for providing arbitrary extensions, so maybe you could encode your data there?
So in theory you could carry authorization metadata in a v3 extension, but I'm not aware of a standardized extension for doing this, so you're probably looking at defining a custom extension (which is possible, but a bit annoying). Sorry for only giving a half-answer.