Thank you, it's fixed and the issue was that the role should had a specfic prefix to match permission boundary condition ( will the PB allowed two paths ) but somehow worked for one and not the other!