public function validateRoleInsert(AbstractRoleSubject $ars, Role $role)
    {
        $total = $this->countUsersByRoleIncludingGroup($role);

        //cli always win!
        if ('ROLE_ADMIN' === $role->getName() && 'cli' === php_sapi_name() ||
            //web installer too
            null === $this->container->get('security.token_storage')->getToken()) {
            return true;
        }

        if ('ROLE_ADMIN' === $role->getName() && !$this->container->get('security.authorization_checker')->isGranted('ROLE_ADMIN')) {
            return false;
        }

        //if we already have the role, then it's ok
        if ($ars->hasRole($role->getName())) {
            return true;
        }

        if (null === $role->getMaxUsers()) {
            return true;
        }

        if ($role->getWorkspace()) {
            $maxUsers = $role->getWorkspace()->getMaxUsers();
            $countByWorkspace = $this->container->get('claroline.api.finder')->fetch(
              User::class,
              ['workspace' => $role->getWorkspace()->getUuid()],
              null,
              0,
              -1,
              true
            );

            if ($maxUsers <= $countByWorkspace) {
                return false;
            }
        }

        if ($ars instanceof User) {
            return $total < $role->getMaxUsers();
        }

        if ($ars instanceof Group) {
            $userCount = $this->userRepo->countUsersOfGroup($ars);
            $userWithRoleCount = $this->userRepo->countUsersOfGroupByRole($ars, $role);

            return $total + $userCount - $userWithRoleCount < $role->getMaxUsers();
        }

        return false;
    }