Permissions and roles domain restriction