user roles -> generalisation into group roles