I think lockout seperated by Role would be appropriate

Tome-cap keep as-is IF above is done.