keys/values/roles: When are empty strings legal?

[clarisma]

Clarify if these assumptions are correct:

• Keys cannot be empty (such a tag should be removed)
• Values cannot be empty (such a tag should be removed)
• Roles can be empty