add info on eval access to the built-in roles document