Returns the roles an application requires, read off a view or record the caller already holds.
a view or a record, or null for an unknown application
the role names, never empty
Returns the roles an application requires, read off a view or record the caller already holds.