If you are assigned only to one or more restricted shell environment roles, you are only allowed to run commands within the dzsh shell. Within the restricted shell, you can only be in one active role at a time to prevent ambiguity about the commands you can run or what account should be used to execute those commands.
For example, if you are assigned the lab_staff restricted shell environment role that specifies that the tar command should run as root, and also the temps restricted shell environment role that specifies that the tar command should be run as the account tmp_admin, you need to specify which role you are using to run the tar command under the proper account.
You can see what roles are assigned to you, as well as switch between roles, using the role command. For example, to view the list of roles to choose from, you would type:
$ role -ls
To choose the lab_staff role, you would type:
$ role lab_staff