practicable AllowExtra role

Current implementation does not work with AllowExtra role