via user defined roles or something similar