with role assignemnt, can get a token

Change-Id: I2d17951068a31dc8122ab5c835044706b333610a
split rules

Change-Id: Ie080341af5bcdc78048febcc2226a4927f76379b