grant roles by domain instead of project