You could keep the role information in memory pretty easily though. A lot setups don’t have that many roles (even big enterprise deployments I’ve seen tend not

You could keep the role information in memory pretty easily though. A lot setups don’t have that many roles (even big enterprise deployments I’ve seen tend not be more than 1000, and that’s pretty extreme). The roles per user and auth of the user on the other scales linearly with users and is harder to keep in memory.