security-proxy - begin the runtime mgmt of role filters

unfinished yet