permit updates for >= role ids