[PATCH 1/2] refactored role/privilege model