roles allowed correctly set