different way to handle role-permission relationship based on user-group from the identity module