move roles to toplevel