set permissions easily for roles