you can try using roles_custom.xmlas a workaround you can restrict using roles.xml under /conf/roles folder