What is the basic rule for role assignment?

A subject can execute a transaction only if the subject has selected or been assigned a role.

A subject can only access or modify objects in an authorized way.

A subject can execute a transaction only if the transaction is authorized for the subject$$s active role.

A subject$$s active role must be authorized for the subject.