create trigger role_insert for role after insert execute 
(
  var error integer;
  begin
    if type <> 'L' and type <> 'P' and type <> 'C' and type <> 'S' then set error = 1;
    if type = 'L' then begin
      set error = 0;
      select count(*) as other from ket.role where enterprise_id = :enterprise_id and network_id = :network_id and id <> :id;
      fetch into :error;
    end;
    if type = 'C' then begin
      set error = 0;
      select count(*) as other from ket.role where enterprise_id = :enterprise_id and network_id = :network_id and type not in ('P', 'S') and id <> :id;
      fetch into :error;
    end;
    if type = 'P' or type = 'S' then begin
      set error = 0;
      select count(*) as other from ket.role where enterprise_id = :enterprise_id and network_id = :network_id and type <> 'C' and id <> :id;
      fetch into :error;
    end;
    if error > 0 then stop(-30000, 'Invalid role in trigger: ROLE_INSERT');
  end;
)