Unique role name. Cannot be one of the built-in role names, which are rejected with 400: Admin, Developer, AIBIDeveloper, D3User, AIBIUser, AIBIViewer, Guest, EmbedUser. (The console additionally refuses None and All in its own role builder; those are accepted here.)