similarly for roles - when a user was granted a role, we had an admin service that would make a record of that in its database and then fire an event