DA Grants Role Use Case.

|4. DA Grants Role Use Case
|--------------------------
|The DA grants a role to the previously provisioned user.
|The user then logs into the application.
|The application should somehow reflect the rights granted to the user 
via the new role membership.

This use case requires the requestor to modify a reference.
I suppose that the user could actually log in to the application,
but it's not obvious how the application should reflect the rights granted
(and even less obvious how this would be reflected to a programmatic 
client).

Why doesn't the requestor simply use the 'lookup' operation
to verify that the role reference has been added?