We extended the OPC UA base information model with standard user authorization mechanisms including standard configuration options.

But not all variations of existing systems or requirements can be covered with the features defined by OPC UA. We always said vendor specific mechanisms can be combined with standard mechanisms.

We have Roles, identity mapping for Roles and we have permission settings per Role on the Nodes.

A server may want to use the standard permission configuration but is not able to cover all use cases with the defined Role configuration.

At the moment, F.3.1 RoleType Definition defines the following for Identities:
"The Identities Property specifies the currently configured rules for mapping a UserIdentityToken to the Role. If this Property is an empty array, then the Role cannot be granted to any Session."

It is necessary to have a Role object to configure the permissions on a Node but there is no way to indicate that the Role configuration is vendor specific. One option would be to expose only the mandatory Identities property and to not allow Read/Write access to the value. Another (preferred) option is to extend the criteriaType enumeration with a custom option. This would tell a client that the Role is not configurable with standard mechanisms.