Fix default perms for role/environment