-- Add the restricted OA operator role without changing any existing account.
ALTER TYPE "RoleCode" ADD VALUE IF NOT EXISTS 'system_admin' BEFORE 'admin';