beginning of permission role settings