add PK to role ref permissions