RBAC assignments that only apply to the current request