Same person can be admin and auditor and custom authorization attributes added