admin: query initial app roles