Each user can be assigned a role for each application. This can be done via the API by updating the user and specifying the relationship 'user_to_app_to_role_by_user_id'.