which means that the sort of disambiguation you're talking about is difficult - you'd need a separate role for both users with a separate set of permissions