As far as I can tell you can grant execute privilege to a role, am I missing something ?