@legrego @ebeahan Do you think I'm conflating two things here, by discussing roles and groups together?

I tend to think of groups as a collection of users, whereas a role is a collection of privileges. Groups are often used to model user roles within an organization though.

In my opinion, I think it makes sense to treat these as separate concepts, and only mention roles here

Conversely, do you think group.roles would be appropriate, then?

I realize ES doesn't have the concept of groups. But in systems that do, roles/privileges can be granted to a group as well.

Note that I'm just trying to make sure we're not missing anything obvious here. But it's probably fine to move forward with adding only this one field, and only add group.role later, if it becomes necessary.

I thought about if a group.roles field would be appropriate too.

While roles assigned to groups, it's ultimately a user who authenticates and is authorized with the roles group membership grants. So I'm not sure if group.role would be as useful right away, but I also agree we could easily add it later if necessary.

I agree with @ebeahan - we can introduce group.role at a later date if the need arises

I've completely removed all talk about groups. Actually the field description is only the short description now:

Array of user roles at the time of the event.

Do you think anything else is needed here?

Concise but clear - I think the short description works.