One of the use case of `Roles` is to shield certain resources (endpoints) of services from Read/Write operations. For example, when we have OAuth & Rules enabled (in `cd_ambient_conf.xml`), only users in `CD` and `implementer` roles can perform GET/POST requests on content service.

The `provider` role is used when registering capabilities with discovery service (clientId=registration).

`implementer` role is similar to CD role except for the access to deployer endpoints.

Currently the shielding of resources are internal to CD services and only option available is enable/disable is completely. So, adding new roles is not currently supported.