add secure.role and secure.permission