The include-all attribute if set to true will mean that all authenticated users will be assigned a role provided that they have not been matched on the exclude list.

At the same time whilst in this area, the individual include/exclude mappings use an arbitrary value in the address, this should be persisted as an alias in the XML so that when the model is reloaded addresses will be consistent.