The roles associated with the UserMemento will be based on the configured security (typically Shiro).

In addition, when using the Web UI (Wicket viewer) there will be an additional "org.apache.causeway.viewer.wicket.roles.USER" role; this is used internally to restrict access to web pages without authenticating.