[Matahari] double checking on using auth credentials to restrict roles