diff --git a/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/RoleParser.cs b/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/RoleParser.cs
new file mode 100644
index 0000000..c233a19
--- /dev/null
+++ b/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/RoleParser.cs
@@ -0,0 +1,29 @@
+namespace ZB.MOM.WW.OtOpcUa.Cluster;
+
+public static class RoleParser
+{
+    private static readonly HashSet<string> Allowed = new(StringComparer.Ordinal)
+    {
+        "admin", "driver", "dev",
+    };
+
+    public static string[] Parse(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return Array.Empty<string>();
+
+        var roles = raw
+            .Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+            .Select(r => r.ToLowerInvariant())
+            .Distinct()
+            .ToArray();
+
+        foreach (var r in roles)
+        {
+            if (!Allowed.Contains(r))
+                throw new ArgumentException(
+                    $"Unknown role '{r}'. Allowed: {string.Join(", ", Allowed)}.", nameof(raw));
+        }
+
+        return roles;
+    }
+}