Better way to ensure role permissions