nested roles and override_attributes