Thanks for your reply @yetitwo - I understand how the binding works now. Would you recommend the new way, with unique instances of roles for each user that will be assigned it, or the previous iteration where the role is static and only the binding is unique per user? How big of a performance difference is there? It seems like duplicating role definitions for each user would create some challenges if roles are modified.