the UPS currently has two roles:
For simplicity we should go w/ just one role, the admin role. that every user sees all.