Add role constraints for xen role