Constant ROLE_SCOPE_PREFIX 

pub const ROLE_SCOPE_PREFIX: &str = "role:";

A scope that names a role instead of a capability: role:<name>, for example role:operator.

A device’s role is whatever its enrolment granted. Scopes are stored with the device record when it enrols (by an enrolment code or a pairing window the owner issued) and read back after the request’s signature verified, so a role taken from Caller::role is the role of the signing device: no environment variable, header or request field can set it. Gate a method on a role by naming the role scope in its MethodPolicy: MethodPolicy::remote(["role:operator"]).