Implementing "function" support for dynamic rbacs