roles must be lowercase