Everything the roles & permissions page needs to render every role at once. memberCount counts only users of the calling company, so a shared base role does not expose another company's headcount. editable is false for shared base roles, which every mutation on this controller rejects.