fixes to role permission implementation