add more fine-grained RBAC bypass