anchor.diff:  roles_spock() ->
       [{admin, [],
         [{name, <<"Admin">>},
  -       {desc, <<"Can manage ALL cluster features including security.">>}],
  +       {desc, <<"Can manage ALL cluster features including security.">>},
  +       {ce, true}],
         [{[], all}]},
        {ro_admin, [],
         [{name, <<"Read Only Admin">>},
  -       {desc, <<"Can view ALL cluster features.">>}],
  +       {desc, <<"Can view ALL cluster features.">>},
  +       {ce, true}],
         [{[{bucket, any}, password], none},
          {[{bucket, any}, data], none},
          {[admin, security], [read]},
  
positive.code:                 fun (BucketName, Acc1) ->
                          [{{Role, [BucketName]}, Props} | Acc1]
                  end, Acc, BucketNames)
        end, [], get_definitions(Config)).
  
  -spec validate_role(rbac_role(), [rbac_role_def()], ns_config()) -> boolean().
  validate_role(Role, Definitions, Config) when is_atom(Role) ->
  
negative.code:             roles_spock();
          false ->
              roles_45()
      end.
  
  get_definitions_filtered_for_rest_api(Config) ->
      case cluster_compat_mode:is_enterprise() of
          true ->
              get_definitions(Config);
          false ->
              [Role ||
                  {_, _, Props, _} = Role <- get_definitions(Config),
                  proplists:get_value(ce, Props, false) =:= true]
      end.
  
  -spec object_match(rbac_permission_object(), rbac_permission_pattern_object()) ->
  