binding for allowed roles to assign endpoint