roles and capabilities