> if so, the callback should be after_create.

What happens when a user removes all his roles, and after the update he doesn't have any permissions? Shouldn't we ensure he always has a default role if none is provided?