It's not a stand-alone role, but permission that has to be added to any roles that will be using CDATA