[support] One role per user