set of privileges for employee has been removed since every user is employee; now setting of role other than EMPLOYEE assumes assignment of higher privileges