refactoring for access roles