@witlessbird Roles have a hierarchy. IMO a "Admin" role (for example) permissions should contain "Anonymous"  role permissions plus others. This way we don't have to apply several roles who overlap, we apply more roles to a user if they complete each other.

> Or does the RBAC design require every user have Anonymous? (Can I get a link to the design doc please?)

+1, I didn't understood from the code if a user should always have this role. Tests fail if we always set this role, this is why I committed this change.