added access check by role