but even in that case, you talk about a user having a role on a resource, and saying that a user has a role by itself doesn't really mean anything