Thanks. I was already thinking of doing the "alternative". It would probably be better long run as I won't have to remember to revoke everything for new users/roles.

Buddy