Trust roles as a nested collection

Change-Id: I5016df33090a98100fa37ff1749212a4af7eb049