we do allow role inheritance, but its not intended to be deep. 1-2 levels. and should be an edge case