fixed role permissions