Auth: assign event roles (2)