fixed role checking: one permitting role is enough