add roles and initial permissions