AddRole seems like a simple method, but it requires at least one roleitem. Add K2 service as default?