I'm surprised that the same object / behaviour is used for:
 + **viewing a resource**
    + in which case we want an authz check
 + **listing resources**
    + in which case we want a list of roles
 + **editing the properties of a resource**
    + in which case we want a persistant list of roles which we can fiddle with.