add role on install
update TODO