Add user role check to grant()