add rule about roles