(wip) refactoring fields permission levels to roles