Checks what caller may do with the aggregate.
Checks what a caller subject may do, holding claims, with roles (its roles claim).
roles