Move managed stuff to own base_managed role