update README to explain where roles come form