This paper maintains that for an access-control (AC) mechanism tosupport a wide range of policies, it is best to dispense with any built-insemantics for roles in the mechanism itself---be it the semantics of RBAC, orany other---leaving such semantics to be defined by particular policies. Inother words, an AC mechanism should be sensitive to roles, allowingspecific policies to take roles into account for their authorizationdecisions. But it should not be based on any particular interpretationof the structure of roles, or of their effect on access control. The validity of this assertion is demonstrated by showing that a mechanismcalled Law-governed interaction (LGI), which has no built-in concept of roles,can nevertheless support a wide range of policies that take roles intoaccount. These include RBAC itself, its various generalizations, as well asconcepts like budgetary controls, which seems to be quite inconsistent withRBAC. All such policies can be formulated, deployed, and enforced, via asingle scalable, and fully implemented LGI mechanism.