Rundeck forces all authenticated principals to be inside role 'user' before let them in