It can happen that
1) A new permission is added in foreman (as it was in https://github.com/theforeman/foreman/pull/9803)
2) A role in a plugin is extended to have the permission from 1) (as it was in https://github.com/theforeman/foreman_ansible/pull/633)
3) When the installer runs, it skips explicit seeds (foreman-rake db:seed) because explicit seeds only run when the db was migrated
4) Seeds are supposed to be seeded when the rails process boots up, but because of the load order the plugin seems to be initialized before its dependencies (the permission in core) are seeded