roles couldn't choose from all available permissions because they were
not computed...