Using roles to control user permissions