update README to explain where roles come from