make users the default entry point in role assignment