security fix - only producers can change role