GBE-463: persist assignment users/groups: all roles but Administrator