EST-258: can assign multiple roles to a group with permissions being concatenated