check roles on allow