@toltmanns is correct, that should work. alternatively, you can restrict the restlet deployment to exclude the user/role too