looks like `domain_memberships` is available in the user index, so you can just use the role id from there?