Entity access by role