user-defined roles are easily doable though