We do not maintain Su24, auth objects are added directly to the roles, we do not touch our roles during an upgrade unless there is something that must be changed and we find that out through functional testing and side effect reviews. Public Sector experience with roles segregation by business area / profit center.