I'm using downloadable roles to send back ACL definition (which defines default internal tools that users are authorized to access) to the controller. Another requirement is that each user should be limited to 20M of bandwidth. I tried using policer profile in downloadable roles (available in CPPM configuration) but the controller always complained "unsupported keyword" when it encounters cir command received from CPPM. So I guess only session ACL currently works with downloadable roles.
If I want to satisfy the requirement of 20M of bandwidth per user, I think the only way to do it is to define role locally on the controller, as you have mentioned. Downloadable roles and locally defined role probably cannot work and complement each other. Or am I missing something?
Thank you,