fix up per group roles