fix(migrations): remove fake test-data seeds, backfill lost permissions, merge redundant roles

Migration-hygiene fixes found while auditing whether a fresh database would
end up with the same schema/permissions/roles as this dev database.

1. Remove fake test-data seed migrations

   0449_seed_aml_test_alerts.xml and 0459_seed_aml_alerts_awaiting_review.xml
   unconditionally inserted 3 fictional clients (CLIENT_RAJESH/SONIA/VIKRAM)
   and 5 fake AML alerts against them on every environment, including
   production if this migration path ever ran there. 0459's own comment
   confirms it was written purely to exercise the AML review UI. Deleted
   both files and their <include> entries; cleaned the same fake rows out
   of this dev database (3 clients, 5 alerts, plus the now-orphaned
   databasechangelog bookkeeping rows for the two deleted files).

2. Backfill 3 permissions lost to a migration-number collision

   Auditing all 2712 changesets applied to this dev database against the
   current codebase found 18 changeset filenames with no matching file
   anywhere in git; changelog-tenant.xml itself already documents the root
   cause (multiple branches independently reusing the same numeric prefix
   for unrelated migrations, e.g. 0456-0462 twice). Cross-checking each
   affected table/permission against actual Java usage (@CommandType
   handlers, domain/API classes, and both permission-insert styles used in
   this codebase -- Liquibase <insert> columns and raw <sql> literals)
   showed 15 of the 18 are genuinely dead (reconciliation-batch/settlement-
   cycle prototype tables, fixed asset/inventory tracking) with zero
   current code referencing them, so nothing to backfill there. The
   remaining 3 -- MENU_RECONCILIATION, READ_RECONCILIATION,
   SIDEBAR_RECONCILIATION -- gate a live module (CashReconciliation /
   ClearingReconciliation have real API resources and domain classes) but
   were never seeded by any migration; without them a fresh database can
   build and expose the reconciliation screens with no way to grant a role
   access to them. Added 0491_add_reconciliation_menu_permissions.xml.

3. Merge two pairs of redundant roles

   - "Bank Cashier" (4 fund-transfer permissions, 0 of which overlapped
     "CASHIER", 0 users assigned) folded into CASHIER.
   - "AML Officer" (2 permissions, both already present on "Principal
     Officer", 0 users assigned) folded into Principal Officer.
   Both migrations copy any missing permissions and move any assigned
   users onto the surviving role before deleting the redundant one, so
   they're safe to run against an environment that isn't empty the way
   this dev database is. Applied the same merge directly to this dev
   database's m_role / m_role_permission / m_appuser_role rows.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

@@ -501,7 +501,6 @@
     <include file="parts/0446_create_clerk_share_closure_request.xml" relativeToChangelogFile="true"/>
     <include file="parts/0447_add_tiered_thresholds_and_low_balance_rule.xml" relativeToChangelogFile="true"/>
     <include file="parts/0448_fill_client_risk_rule_income_turnover_nulls.xml" relativeToChangelogFile="true"/>
-    <include file="parts/0449_seed_aml_test_alerts.xml" relativeToChangelogFile="true"/>
     <include file="parts/0450_add_aml_rule_limit_bands.xml" relativeToChangelogFile="true"/>
     <include file="parts/0451_seed_branch_offices.xml" relativeToChangelogFile="true"/>
     <include file="parts/0452_seed_aml_manual_referral_rule.xml" relativeToChangelogFile="true"/>
@@ -523,7 +522,6 @@
     <include file="parts/0456_add_freeze_date_and_amount_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0457_add_unfreeze_date_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0458_add_no_debit_date_to_client_kyc.xml" relativeToChangelogFile="true"/>
-    <include file="parts/0459_seed_aml_alerts_awaiting_review.xml" relativeToChangelogFile="true"/>
     <include file="parts/0460_create_aml_recurring_review.xml" relativeToChangelogFile="true"/>
     <include file="parts/0461_add_pan_declaration_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0462_add_aadhaar_enrolment_receipt_to_client_kyc.xml" relativeToChangelogFile="true"/>
@@ -570,4 +568,7 @@
     <include file="parts/0491_add_funding_source_to_share_transaction.xml" relativeToChangelogFile="true"/>
     <include file="parts/0492_add_additional_collection_ids_to_share_transaction.xml" relativeToChangelogFile="true"/>
     <include file="parts/0493_enable_maker_checker_for_share_account_create.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0494_add_reconciliation_menu_permissions.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0495_merge_bank_cashier_role_into_cashier.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0496_merge_aml_officer_role_into_principal_officer.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0449_seed_aml_test_alerts.xml

@@ -1,108 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-
-    Licensed to the Apache Software Foundation (ASF) under one
-    or more contributor license agreements. See the NOTICE file
-    distributed with this work for additional information
-    regarding copyright ownership. The ASF licenses this file
-    to you under the Apache License, Version 2.0 (the
-    "License"); you may not use this file except in compliance
-    with the License. You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing,
-    software distributed under the License is distributed on an
-    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-    KIND, either express or implied. See the License for the
-    specific language governing permissions and limitations
-    under the License.
-
--->
-<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
-                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
-
-    <changeSet author="fineract" id="0449-1">
-        <preConditions onFail="MARK_RAN">
-            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM m_client WHERE external_id = 'CLIENT_RAJESH'</sqlCheck>
-        </preConditions>
-        <sql>
-            INSERT INTO m_client (
-                account_no, external_id, status_enum, office_id, display_name,
-                fullname, is_staff, activation_date, office_joining_date,
-                submittedon_date, legal_form_enum,
-                created_on_utc, created_by,
-                last_modified_on_utc, last_modified_by,
-                cif_number
-            )
-            VALUES 
-            (
-                'ACC0000002', 'CLIENT_RAJESH', 300, 1, 'Rajesh Kumar',
-                'Rajesh Kumar', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 1,
-                NOW(), 1,
-                NOW(), 1,
-                'CIF_RAJESH'
-            ),
-            (
-                'ACC0000003', 'CLIENT_SONIA', 300, 1, 'Sonia Sharma',
-                'Sonia Sharma', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 1,
-                NOW(), 1,
-                NOW(), 1,
-                'CIF_SONIA'
-            ),
-            (
-                'ACC0000004', 'CLIENT_VIKRAM', 300, 1, 'Vikram Malhotra',
-                'Vikram Malhotra', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 1,
-                NOW(), 1,
-                NOW(), 1,
-                'CIF_VIKRAM'
-            );
-        </sql>
-    </changeSet>
-
-    <changeSet author="fineract" id="0449-2">
-        <preConditions onFail="MARK_RAN">
-            <sqlCheck expectedResult="0">
-                SELECT COUNT(*) FROM m_aml_alert a 
-                JOIN m_client c ON a.client_id = c.id 
-                WHERE c.external_id IN ('CLIENT_RAJESH', 'CLIENT_SONIA', 'CLIENT_VIKRAM')
-            </sqlCheck>
-        </preConditions>
-        <sql>
-            INSERT INTO m_aml_alert (
-                transaction_type, transaction_id, client_id, rule_id, amount, currency_code,
-                raised_on, status, created_by, created_on_utc, last_modified_by, last_modified_on_utc, version
-            )
-            VALUES
-            (
-                'SAVINGS', 1001, 
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_RAJESH'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'LARGE_CASH_TXN_25L'),
-                3500000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            ),
-            (
-                'SAVINGS', 1002, 
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_SONIA'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'STRUCTURING_BELOW_10L'),
-                995000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            ),
-            (
-                'SAVINGS', 1003, 
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_VIKRAM'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'PEP_ACCOUNT_MONITORING'),
-                75000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            );
-        </sql>
-    </changeSet>
-
-</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0459_seed_aml_alerts_awaiting_review.xml

@@ -1,72 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-
-    Licensed to the Apache Software Foundation (ASF) under one
-    or more contributor license agreements. See the NOTICE file
-    distributed with this work for additional information
-    regarding copyright ownership. The ASF licenses this file
-    to you under the Apache License, Version 2.0 (the
-    "License"); you may not use this file except in compliance
-    with the License. You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing,
-    software distributed under the License is distributed on an
-    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-    KIND, either express or implied. See the License for the
-    specific language governing permissions and limitations
-    under the License.
-
--->
-<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
-                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
-
-    <!--
-        Two alerts left in RAISED so the Whitelist / Suspicious actions on the AML Rules Master
-        "Flagged Transactions" tab can be exercised. The alerts seeded in 0449 have all been
-        dispositioned, which correctly hides the buttons and leaves nothing to test against.
-
-        Transaction ids 2001/2002 are stubs — they do not point at rows in m_savings_account_transaction.
-        That is deliberate and matches 0449: the review path (whitelist, or escalate opening an STR
-        case) reads only the alert row, so a stub id exercises the full workflow. Only a screen that
-        drills through to the underlying transaction would notice.
-    -->
-    <changeSet author="Antigravity" id="0459-1">
-        <preConditions onFail="MARK_RAN">
-            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM m_aml_alert WHERE transaction_id IN (2001, 2002)</sqlCheck>
-            <sqlCheck expectedResult="2">
-                SELECT COUNT(*) FROM m_client WHERE external_id IN ('CLIENT_RAJESH', 'CLIENT_SONIA')
-            </sqlCheck>
-            <sqlCheck expectedResult="2">
-                SELECT COUNT(*) FROM m_aml_transaction_rule
-                WHERE rule_code IN ('LARGE_CASH_TXN_25L', 'STRUCTURING_BELOW_10L')
-            </sqlCheck>
-        </preConditions>
-        <sql>
-            INSERT INTO m_aml_alert (
-                transaction_type, transaction_id, client_id, rule_id, amount, currency_code,
-                raised_on, status, created_by, created_on_utc, last_modified_by, last_modified_on_utc, version
-            )
-            VALUES
-            (
-                'SAVINGS', 2001,
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_RAJESH'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'LARGE_CASH_TXN_25L'),
-                4200000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            ),
-            (
-                'SAVINGS', 2002,
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_SONIA'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'STRUCTURING_BELOW_10L'),
-                980000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            );
-        </sql>
-    </changeSet>
-
-</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0494_add_reconciliation_menu_permissions.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
+
+    <!--
+        The Cash/Clearing Reconciliation module (0018_cash_reconciliation.xml,
+        0393_clearing_settlement_reconciliation.xml, and their per-action permissions such as
+        CREATE_CASHRECONCILIATION / READ_CLEARINGRECONCILIATION) is live, but the three
+        top-level permissions that gate its own nav entry and section-level read access were
+        never seeded by any migration: this dev database only has them because they were
+        inserted by hand at some point. Without this file a fresh database would build and
+        expose the reconciliation screens with no way to grant a role access to them at all.
+    -->
+    <changeSet id="0494-reconciliation-nav-permissions" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM m_permission WHERE code = 'MENU_RECONCILIATION'</sqlCheck>
+        </preConditions>
+        <insert tableName="m_permission">
+            <column name="grouping" value="heading_menu"/>
+            <column name="code" value="MENU_RECONCILIATION"/>
+            <column name="entity_name" value="MENU"/>
+            <column name="action_name" value="RECONCILIATION"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="reconciliation"/>
+            <column name="code" value="READ_RECONCILIATION"/>
+            <column name="entity_name" value="RECONCILIATION"/>
+            <column name="action_name" value="READ"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="special"/>
+            <column name="code" value="SIDEBAR_RECONCILIATION"/>
+            <column name="entity_name" value="SIDEBAR_RECONCILIATION"/>
+            <column name="action_name" value="READ"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0495_merge_bank_cashier_role_into_cashier.xml

@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
+
+    <!--
+        "CASHIER" and "Bank Cashier" were two separate roles covering overlapping teller duties;
+        "Bank Cashier" only ever carried 4 fund-transfer permissions that CASHIER didn't already
+        have. Folds Bank Cashier into CASHIER: copies its permissions onto CASHIER, moves any
+        users still assigned to Bank Cashier onto CASHIER, then removes the now-redundant role.
+        Written to run in this order so no user or permission mapping is ever briefly unowned.
+    -->
+
+    <changeSet id="0495-copy-bank-cashier-permissions-to-cashier" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Bank Cashier'</sqlCheck>
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'CASHIER'</sqlCheck>
+        </preConditions>
+        <sql>
+            INSERT INTO m_role_permission (role_id, permission_id)
+            SELECT (SELECT id FROM m_role WHERE name = 'CASHIER'), bc_rp.permission_id
+            FROM m_role_permission bc_rp
+            WHERE bc_rp.role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier')
+              AND bc_rp.permission_id NOT IN (
+                  SELECT permission_id FROM m_role_permission
+                  WHERE role_id = (SELECT id FROM m_role WHERE name = 'CASHIER')
+              );
+        </sql>
+    </changeSet>
+
+    <changeSet id="0495-move-bank-cashier-users-to-cashier" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Bank Cashier'</sqlCheck>
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'CASHIER'</sqlCheck>
+        </preConditions>
+        <sql>
+            INSERT INTO m_appuser_role (appuser_id, role_id)
+            SELECT bc_ur.appuser_id, (SELECT id FROM m_role WHERE name = 'CASHIER')
+            FROM m_appuser_role bc_ur
+            WHERE bc_ur.role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier')
+              AND bc_ur.appuser_id NOT IN (
+                  SELECT appuser_id FROM m_appuser_role
+                  WHERE role_id = (SELECT id FROM m_role WHERE name = 'CASHIER')
+              );
+
+            DELETE FROM m_appuser_role
+            WHERE role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier');
+        </sql>
+    </changeSet>
+
+    <changeSet id="0495-remove-bank-cashier-role" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Bank Cashier'</sqlCheck>
+        </preConditions>
+        <sql>
+            DELETE FROM m_role_permission WHERE role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier');
+            DELETE FROM m_role WHERE name = 'Bank Cashier';
+        </sql>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0496_merge_aml_officer_role_into_principal_officer.xml

@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
+
+    <!--
+        "AML Officer" (MENU_AML_COMPLIANCE, REVIEW_AML_ALERT) is a strict subset of "Principal
+        Officer" (same two, plus CONCLUDE_AML_STR), so this is a straight removal, not a copy:
+        nothing AML Officer grants is missing from Principal Officer already. Moves any users
+        still on AML Officer onto Principal Officer first (defensive: this dev database has
+        none on either role, but other environments may), then removes the now-redundant role.
+    -->
+
+    <changeSet id="0496-move-aml-officer-users-to-principal-officer" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'AML Officer'</sqlCheck>
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Principal Officer'</sqlCheck>
+        </preConditions>
+        <sql>
+            INSERT INTO m_appuser_role (appuser_id, role_id)
+            SELECT ao_ur.appuser_id, (SELECT id FROM m_role WHERE name = 'Principal Officer')
+            FROM m_appuser_role ao_ur
+            WHERE ao_ur.role_id = (SELECT id FROM m_role WHERE name = 'AML Officer')
+              AND ao_ur.appuser_id NOT IN (
+                  SELECT appuser_id FROM m_appuser_role
+                  WHERE role_id = (SELECT id FROM m_role WHERE name = 'Principal Officer')
+              );
+
+            DELETE FROM m_appuser_role
+            WHERE role_id = (SELECT id FROM m_role WHERE name = 'AML Officer');
+        </sql>
+    </changeSet>
+
+    <changeSet id="0496-remove-aml-officer-role" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'AML Officer'</sqlCheck>
+        </preConditions>
+        <sql>
+            DELETE FROM m_role_permission WHERE role_id = (SELECT id FROM m_role WHERE name = 'AML Officer');
+            DELETE FROM m_role WHERE name = 'AML Officer';
+        </sql>
+    </changeSet>
+
+</databaseChangeLog>