add protections against unauthorized role elevation