I guess I didn't expect roles to be versioned. If they weren't versioned then you wouldn't need a separate table for each type (module, collection, folder) because of SQLAlchemy ; )