Good point. Should I just return empty array (or default role... I think no role at all is better as it will always be not granted then).