Currently the managed domain RBAC work does not handle propagation of the config to slave host controllers (which means RBAC doesn't work with multi-host domains.) This JIRA is the tracker for that aspect of the work.