assign roles correctly