Stephen Crawley (Migrated from SEC-1334) said:
It is not clear from the documentation that a role name must start with "ROLE" by default. I discovered this by accident when I tried to use "XROLE_ANONYMOUS" and got an exception that complained about the role name being invalid.
Luke Taylor said:
There was already an explanation of this in the Authorization chapter, but I have added some pointers in both the namespace and technical intro chapters where people are likely to come across it first.