Improvements to role-based authorization