Implement pending_roles correctly