add capabilities to roles