Support two-dimensional roles. Fx an account can have different roles for multiple clients