Backport the role_constraints bit to roxy