Comment by ludston

Roles are for services not for users. If you have a read-only Web api then it makes sense to use a read-only role regardless of which user is using it.