Should be on the deployment record. Unless it's a client script, not sure if you can set a role on those