add role checking