Could you add a note to say why we check role access using a dummy user than loading the roles and iterating through them.