RBAC Roles

System roles are seeded from code. Custom roles (prefix custom:) can be edited and deleted.