Currently custom_roles are handled via an upsert. This has lead to accidental role creation rather than updates. Refactor the cli to be explicitcreate andupdate, rather than a singularmerge command.