As the current formulation of roles will be deprecated in Crowd 2.0, it is best to disable roles by default and allow users to explicitly define a role sub-tree if they require it.