Advanced role management backport from 3.2

Change-Id: I039d4c2ef613d3cb4692ce57329d377c9c63bba5
Merge "Advanced role management backport from 3.2"