path "pki_root/roles/*" {
  capabilities = ["create", "update", "read", "delete", "list"]
}