Ah. That's important to note. I took a look at the script that can be used to create the security tables (download link from security help file) to try to wrap my head around this a bit better and I noticed that some tables that have the sproj_pk column (prefixed of course) have a default of 0 and some don't (SFSRoles, SFSPermissions and SFSRestrictions). Is the script wrong or are these columns updated otherwise?

You can call the FillAll() method on the SFSRolesBO object and pass it a project pk of 0.  At runtime, there are no project pks... the SFSProjects table does not exist in the runtime database, and the tables are assumed to have records from only one project.

I need to load the an instance of the SFSRolesBO with all the roles from the security project used by the application. While I can look at the table and figure out what the ID it, it would be much better to just reference the ID used by the security system. How do I do that?