get rid of multiple roles in the requests
simplify permissions