tokens of service users can now contain role claims by requesting them through scopes
AS OF SYSTEM TIME