Three roles to start setting up the access restriction of your lab