typically assigning the object role would using exclusion (

-

) to exclude the "global" roles' users