isnt it better to call this roleassignments? because if we still support assignments with limitations, a role != an assignment...