refactor roles and privileges