support multi-tenant roles