you need access granted directly and not via a role