My understanding is that has got more to do with the fact that is a scalar list (thanks @nilan) — if it were to be

roles: Role!

rather than what I have now, it would work (as per docs: https://www.graph.cool/docs/tutorials/auth/authorization-for-a-cms-miesho4goo/)