Either you're doing that or you're deploying the script to only those Roles or your maintaining a list of allowed roles within the script or a custom record somewhere; either way, you're doing that work