Error (or at least confusing statements) in the 12.1 Security Guide

Question

On Page 4-16 under Creating a common role, one paragraph states:
Set the CONTAINER clause to ALL. In most cases, omitting this clause from the CREATE ROLE statement or setting it to CURRENT creates the role as a local role and applies it to the current PDB only. However, if you are logged in to the root and omit the CONTAINER clause, then by default the role is created as a common role, not a local role. You can create common roles only in the root.
The first part of that paragraph states (or at least implies) that creating a role while connected to a PDB will create a common role is CONTAINER is set to ALL.  The last sentence states that you can create common roles only in the root. The implication is that you can create common roles only while connected to root, which would invalidate the earlier statements.

Answer 1

Hi Matthew,
Thanks for catching this error, and I apologize for the confusion! To create a common role, you must be in the root. I've reworded the section to say the following:
To create a common role, follow these rules:
Ensure that you are in the root. You cannot create common roles from a PDB. To check if you are in the root, run the show con_name command. The output should indicate that you are in the root (CDB$ROOT).
Ensure that the name that you give the common role starts with C## or c## and contain only ASCII or EDCDIC characters. Note that this requirement does not apply to the names of existing Oracle-supplied roles, such as DBA or RESOURCE.
Optionally, set the CONTAINER clause to ALL. As long as you are in the root, if you omit setting the CONTAINER = ALL clause, then by default the role is created as a common role.
Thanks,
Pat Huey