Its parameter is a loop invariant, so avoid looking the same user up once
per local role.