final revisions to default roles and permissions