- add validation
- fix saving
- fix restriction by roles