permit and forbid scopes for roles via cli