anchor.diff:                  fun (BucketName, Acc1) ->
                           [{{Role, [BucketName]}, Props} | Acc1]
                   end, Acc, BucketNames)
  -      end, [], get_definitions(Config)).
  +      end, [], get_definitions_filtered_for_rest_api(Config)).
   
   -spec validate_role(rbac_role(), [rbac_role_def()], ns_config()) -> boolean().
   validate_role(Role, Definitions, Config) when is_atom(Role) ->
  
positive.code: roles_spock() ->
      [{admin, [],
        [{name, <<"Admin">>},
         {desc, <<"Can manage ALL cluster features including security.">>}],
        [{[], all}]},
       {ro_admin, [],
        [{name, <<"Read Only Admin">>},
         {desc, <<"Can view ALL cluster features.">>}],
        [{[{bucket, any}, password], none},
         {[{bucket, any}, data], none},
         {[admin, security], [read]},
  
negative.code:        {[], [read]}]},
       {bucket_sasl, [bucket_name],
        [{name, <<"Bucket Full Access">>},
         {desc, <<"Full access to bucket data">>},
         {ce, true}],
        [{[{bucket, bucket_name}, data], all},
         {[{bucket, bucket_name}, views], all},
         {[{bucket, bucket_name}], [read, flush]},
  