Essentially, I have to go back having Role as a type with an N:M relationship on User, just as I had originally designed — should read more carefully 🙂