Add cosign and role restrictions for token manager