First pass of role based authorization