Actually looking at this we did already account for this we just didn't use the right authorize method here. If we change it to just pass in the string names rather than the lightweight User/Ability objects it will call:

````csharp
public bool Authorize(string userName, string abilityName)
{
   IUser user = GetUser(userName);
   IAbility ability = GetAbility(abilityName);
   return Authorize(user, ability);
}
````

which will then pull the full object with roles, etc. already populated.