RBAC can queries roles for the user on the specified resource