Adding a role without selecting either of these makes no sense, and will
be refused by the backend accordingly.