Contextual explanation: Lot’s of Modules we use in our app are categorized by a List called Workgroup (e.g. modules for Suggestions, Decisions, actions…). Workgroup is a property in those modules. We want to limit what a user gets to see in those modules via user roles. One user role corresponds to with one Workgroup. But what's important to know, is that a user has multiple user roles (so using the standard Role functionality is not a solution), and also one workgroup can have multiple User roles.