because of the column 'security' in the bcs_users table. It can have a value NULL, meaning that there does not need to be a special role for the function, or a comma delimited string of role-id's. 
Example:

"home" : role: null, everybody can use it
"editor" : role: "4,5" , everybody with the role 4 or 5 (or 4 and 5?) can use it