changed validator to allow person/role queries from internal