Drop a problematic single-role clause for add_grant and add_revoke, update unit tests