In the Application Navigator, visibility is evaluated at both the application menu level and the module level. A module can specify roles in its Roles field, but when that module Roles field is empty, the module does not add additional role requirements by itself. Instead, the user must still be able to see the application menu that contains the module. That means the effective gate becomes the application menu's access configuration (including any required roles on the application menu). As a result, the module is visible to users who already have access to the application menu, because the module is not restricting access further.
This behavior supports clean navigation design: define broad access at the application menu level, and only add module-level roles when you need to hide specific modules within an otherwise visible application menu.
Options like "snc_internal" or "users with no roles" are not universally correct because module visibility is not determined by those conditions alone. The key rule is: if module Roles is empty, application menu access controls whether users can see the module.