add allow function or no need roles