allow querying by role