if having all the roles and permissions in the same definition (location) is a valid approach