correctly handle when a role is defined as a dict