i needed some extra permissions so that my extension (.ss file) could access a custom record so i created a role with those permissions and attached it to the .ss file (which also has some CAPI methods)