updated access criterias to use all roles the user has assigned, including children (recursive)