use dedicated @roles field for Query.ReadableBy and populate with Everyone if empty