There seems to be a problem with the deplyer role within the domain. In order to operate on doamin deployments, the deplyer requires write access to:

a) /server-group=*
b) /deployment=*

But currently only the later seems to be given. This basically reduces the deployer role to just the abillity to upload contents, but not assign them to server-groups.