role allowed | get foo