anchor.diff:                end
         end).
   
  -validate_role(Role, Definitions, _BucketNames) when is_atom(Role) ->
  -    lists:keymember(Role, 1, Definitions);
  -validate_role({Role, [BucketName]}, Definitions, BucketNames) ->
  -    lists:keymember(Role, 1, Definitions) andalso
  -        lists:member(BucketName, BucketNames).
  +validate_role(Role, Definitions, Config) when is_atom(Role) ->
  +    validate_role(Role, [], Definitions, Config);
  +validate_role({Role, Params}, Definitions, Config) ->
  +    validate_role(Role, Params, Definitions, Config).
  +
  +validate_role(Role, Params, Definitions, Config) ->
  +    case lists:keyfind(Role, 1, Definitions) of
  +        {Role, ParamsDef, _, _} when length(Params) =:= length(ParamsDef) ->
  +            lists:all(fun ({Param, ParamDef}) ->
  +                              lists:member(Param, get_possible_param_values(Config, ParamDef))
  +                      end, lists:zip(Params, ParamsDef));
  +        _ ->
  +            false
  +    end.
   
   store_user(Identity, Name, Roles) ->
       Props = case Name of
  
positive.code:     Roles = compile_roles([{bucket_admin, ["default"]}], preconfigured_roles()),
      ?assertEqual(false, is_allowed({[{bucket,"test"}, data], read}, Roles)),
      ?assertEqual(false, is_allowed({[{bucket, all}], create}, Roles)).
  
negative.code:     ns_config:run_txn(
        fun (Config, SetFn) ->
                {value, Definitions} = ns_config:search(roles_definitions),
  
                UnknownRoles = [Role || Role <- Roles,
                                        not validate_role(Role, Definitions, Config)],
                case UnknownRoles of
                    [] ->
                        Users = ns_config:search(Config, user_roles, []),
  