update permissions, simplify roles