expanding on use of get_roles_with_capability