nested class of secured roles