in general, if the role is not going to be used outside of the context of the particular resource, its recommended to just have users be granted directly on a relation on the repo