Roletickets final

Has work for three role-related tickets, ENG-6818, ENG-7088, ENG-7237, in that order.

Each commit is self-contained for one ticket.

There are also test changes for pro, but they are non-functional.