joe: needs to signal session (sudo related)
    rename session_role_change to session_role_allow