prefer 'all' for all roles