Best practice is to use custom roles