tweaked the role/permissions a bit