initialise role with default permissions