Don't ||= cache roles in case they change mid-usage