yep, it mimics the UI as well (can't add a role to an employee in the UI unless they have access) - also removing access automatically removes all roles