OWNER always has full access and cannot be changed. New roles start with no permissions.