Support role definitions and their assignments in non-root space

Currently the roles must be defined in the administrative stack(s) of the root space. It should be possible to do so in any space.