check access only if roles are defined