Move allowed roles deeper