Card #147 - concept of allowedRoles (when creating GroupRole) and allRoles (all staff roles, used when filtering)