Making role paths work with policy document names