rework server-side AM for dynamic roles