complete implementation for issue #42: it's now possible to add/remove
roles from a fulfillment through actions