makes sense  but if that is the kind of restriction someone wants to enforce  could not they just use the  policies  setting instead of the  roles i do not mean to be a   jerk  i am just trying to understand what extending the semantics of the roles style property protections gets you that is not already available from the policies style property protections 