we are starting to creep quite a lot of data to provider_zone - I'm not sure that's the best place for host -> roles mapping