Use root_group over 'root'.
Deny deployers from using cron.