role name is unique, create builder if null in allow_model_operations