allow global roles (without site_id)
allow global roles (without site_id)