better `get_or_create_tenant'
better role_create
more intelligent role addition & key extraction