The Hidden Risk in User Roles No One Talks About