add RBAC support