started on the IDM layer - added support for managing roles