make role ID under 1000 reserved for system