Apparently, an empty

<restriction>

tag is sometimes required for a role on a custom record object and sometimes it must not exist even in the same custom record definition. Does anyone know what the criteria determines why it works this way?