The user:* is because that’s checking that the role has the permission, the one with the actual user is checking that the user has the role