anchor.diff:  }
   ----
   
  +* to set up a user bob with access to this role plus all available <<default-roles, built-in roles>>:
  ++
  +[source,java]
  +.UserToRole__bob_allRoles.java
  +----
  +public class UserToRole__bob_allRoles extends AbstractUserAndRolesFixtureScript {
  +
  +  public UserToRole__bob_allRoles() {
  +    super(
  +      "bob", "pass",          // <.>
  +      "bob@cratchet.com",     // <.>
  +      "/",                    // <.>
  +      AccountType.LOCAL,      // <.>
  +      Can.of(
  +        RoleAndPerms__UserRw.ROLE_NAME                                            // <.>
  +        , IsisConfiguration.Extensions.Secman.Seed.REGULAR_USER_ROLE_NAME_DEFAULT // <.>
  +        , IsisAppFeatureRoleAndPermissions.ROLE_NAME                   // <.>
  +        , IsisPersistenceJdoMetaModelRoleAndPermissions.ROLE_NAME      // <7>
  +        , IsisExtH2ConsoleRoleAndPermissions.ROLE_NAME                 // <7>
  +        , IsisViewerRestfulObjectsSwaggerRoleAndPermissions.ROLE_NAME  // <7>
  +        , IsisSudoImpersonateRoleAndPermissions.ROLE_NAME              // <7>
  +        , IsisConfigurationRoleAndPermissions.ROLE_NAME                // <7>
  +      ));
  +  }
  +}
  +----
  +
  +<.> username and password.
  +The password is encrypted, not stored in plain text.
  +<.> email address
  +<.> application tenancy
  +<.> local account (rather than delegated, see xref:setting-up-with-shiro.adoc[])
  +<.> application-specific roles
  +<.> regular user access (always required).
  +*Note* that this expects that the default regular user role has been left as its default value.
  +<.> specific access to framework features, see <<default-roles,above>>
  +
  +
  +We can also veto individual members:
  +
   * to set up a "no-delete" role that vetoes the ability to delete objects:
   +
   [source,java]
  
positive.code:     @Override protected void execute(ExecutionContext executionContext) {
          executionContext.executeChildren(this,
                  // roles
                  new RoleAndPerms__HelloRw(),
                  // users
                  new UserToRole__joe_UserRw_but_NoDelete()
          );
      }
  }
  ----
  
  The custom seed service would then ensure that these users/roles existed on startup.
  
  
  [#user-registration-aka-sign-up]
  
negative.code: 
  The full list can be found by searching for subclasses of xref:refguide:extensions:index/secman/applib/role/fixtures/ AbstractRoleAndPermissionsFixtureScript.adoc[AbstractRoleAndPermissionsFixtureScript].
  
  [NOTE]
  ====
  There is no fixture script to setup a role to access the UI features of the applib, or to run fixture scripts; these are included automatically as part of the SecMan's own "regular user".
  ====
  
  
  
  == Fixture scripts and seed service, to setup users and roles
  