Hi Stefan
I saw Bernand reply to you and my attempts at putting the case forward for Non-Prod wasn't successful either 
For production, I agree role should be built and driven via the role menu with SU24 integration. You are explicit in the access you allow. Non-Production, I"m trying to protect the system whilst being more implicit in the access for Developers/etc.
This thread is all about Production so display all doesn't seem appropriate.
Regards
Colleen