During the regular october install using october:install, the user-defined password is overwritten with the random generated string password. Instead, now it uses random password only if the user-defined password defaults to *admin* and if a user did set a custom password, that is used instead.
These are roles defined by a special API code, once a system role code is detected, the role becomes locked and its permissions are sourced from the AuthManager. All permissions are granted to system roles by default, unless otherwise specified. This should make it easier to create client accounts as "Publishers", hiding developer tools like the CMS and Builder plugins by default.
Saifur Rahman Mohsin
Ben Thomson
Samuel Georges
Stefan Talen