exposed roles withing credentials