@al3xicon couldn't you just put all the roles that don't have permissions in the condition? does it have to be dynamic?