abstract denyhosts to a role