policy explains how roles are prepended with R: - what if there's a user called "R:T:F:M"?