permittedRole work