custom roles are now assigned the no access mask