During the account creation process, align users to a particular role based on attributes in their AD account and prohibit them from changing to another role, while allowing an administrator to change that role, if it becomes necessary.