diff --git a/guides/security/aspects.md b/guides/security/aspects.md
index e9243f487..268eb23b5 100644
--- a/guides/security/aspects.md
+++ b/guides/security/aspects.md
@@ -259,8 +259,7 @@ Moreover, technical [MTXs CAP services](../multitenancy/mtxs) may be configured,
 | [cds.xt.ModelProviderService](../multitenancy/mtxs#modelproviderservice) | `/-/cds/model-provider/**` | Internal, technical user<sup>1</sup>
 | [cds.xt.DeploymentService](../multitenancy/mtxs#deploymentservice) | `/-/cds/deployment/**` | | Internal, technical user<sup>1</sup>, or technical role `cds.Subscriber`
 | [cds.xt.SaasProvisioningService](../multitenancy/mtxs#saasprovisioningservice) | `/-/cds/saas-provisioning/**` | Internal, technical user<sup>1</sup>, or technical roles `cds.Subscriber` resp. `mtcallback`
-| [cds.xt.ExtensibilityService](../multitenancy/mtxs#extensibilityservice) | `/-/cds/extensibility/**` | Internal, technical user<sup>1</sup>, or technical roles `cds.ExtensionDeveloper` resp. `cds.UIFlexDeveloper`
-
+| [cds.xt.ExtensibilityService](../multitenancy/mtxs#extensibilityservice) | `/-/cds/extensibility/**` | Internal, technical user<sup>1</sup>, or technical roles `cds.ExtensionDeveloper`
 > <sup>1</sup> The microservice running the MTXS CAP service needs to be deployed to the [application zone](./overview#application-zone)
 and hence has established trust with the CAP application client, for instance given by shared XSUAA instance.
 
diff --git a/node.js/authentication.md b/node.js/authentication.md
index 38bc06def..98ec646f2 100644
--- a/node.js/authentication.md
+++ b/node.js/authentication.md
@@ -239,11 +239,11 @@ The default configuration shipped with `@sap/cds` specifies these users:
 
 ```jsonc
   "users": {
-    "alice": { "tenant": "t1", "roles": [ "cds.Subscriber", "admin" ] },
-    "bob":   { "tenant": "t1", "roles": [ "cds.ExtensionDeveloper", "cds.UIFlexDeveloper" ] },
-    "carol": { "tenant": "t1", "roles": [ "cds.Subscriber", "admin", "cds.ExtensionDeveloper", "cds.UIFlexDeveloper" ] },
-    "dave":  { "tenant": "t1", "roles": [ "cds.Subscriber", "admin" ], "features": [] },
-    "erin":  { "tenant": "t2", "roles": [ "cds.Subscriber", "admin", "cds.ExtensionDeveloper", "cds.UIFlexDeveloper" ] },
+    "alice": { "tenant": "t1", "roles": [ "admin" ] },
+    "bob":   { "tenant": "t1", "roles": [ "cds.ExtensionDeveloper" ] },
+    "carol": { "tenant": "t1", "roles": [ "admin", "cds.ExtensionDeveloper", "cds.UIFlexDeveloper" ] },
+    "dave":  { "tenant": "t1", "roles": [ "admin" ], "features": [] },
+    "erin":  { "tenant": "t2", "roles": [ "admin", "cds.ExtensionDeveloper", "cds.UIFlexDeveloper" ] },
     "fred":  { "tenant": "t2", "features": [ "isbn" ] },
     "me":    { "tenant": "t1", "features": [ "*" ] },
     "yves":  { "roles": [ "internal-user" ] }
diff --git a/node.js/cds-facade.md b/node.js/cds-facade.md
index df459242b..c992e5a88 100644
--- a/node.js/cds-facade.md
+++ b/node.js/cds-facade.md
@@ -193,7 +193,7 @@ Provides access to the effective configuration of the current process, transpare
   kind: 'basic-auth',
   strategy: 'mock',
   users: {
-    alice: { tenant: 't1', roles: [ 'cds.Subscriber', 'admin' ] },
+    alice: { tenant: 't1', roles: [ 'admin' ] },
     bob: { tenant: 't1', roles: [ 'cds.ExtensionDeveloper' ] },
     # ...,
     '*': true