BACKLOG-4041: Make roles hierarchical