App server should install app role (for now)