yeah without knowing your domain i think i'd treat service users as being the same and treat their roles/permissions as the special case rather than treating them differently from a schema perspective