base implementation: user role assignment