moved scheduler permissions upstream to roles