how are you modeling those roles? are they direct relations? user-defined roles? something like the GCP IAM blog post?