I guess it's a silly quirk of the existing system, it writes these kind of relations but it is sometimes doing the auth request for a specific role. It currently writes the relations like this to some db, but with some extra 'role' data.