EZP-20071 - Take role limitations into account for default role identity definer