Owner of the app/everyone with "Add & Edit Role " permission should be able to directly add roles in a bran new Association manager ;)
They should be able to create, edit and delete it directly in the UI. Any modification should instantly be visible on the app locally without doing unnecessary requests to the db.