I would prefer to reverse how this check is done, and just ensure that agent-only hosts don't have roles dashboard, database or master - otherwise they should be able to have any other user-defined role or default.