added get_roles to access control checks