roles for authentication: the models