User model has roles via mandate workflow