add support for enclosing GROUP() role