add documentation about security roles