Moved role constraints into model and removed edit deployment

(cherry picked from commit ba3fd78c67c85e6702b1d54479f5fe1787f5f52a)