add role for temp files (though this will likely go through a lot of changes