disallow changing type of roles in use+status