Use role_assignments, not roles, when communicating with the RM API