As I understand roles they are supposed to be permissions, but with "theme", e.g. ROLE_SMS will grant all necessary privileges for SMS application. But granting ro