`roles` are also required else we give a cryptic failure in our pre-run validation IIRC.