Whatever option you choose, your service implementation should ensure that users cannot query another user's roles and privileges unless they have administrative privileges themselves.
: exposing on the internet a web service which enables anybody to identify privileged user accounts for your back-end is a bad idea.