Original comment by @skearns64:

The Shield Audit Log should optionally include the roles of the user. For auditing purposes, some users want to know what role(s) a user had at the time they were making a given request.

In some cases, it may be desirable to show only the roles that contain privileges that grant access to the resources used in the request, though this seems like a nice-to-have - there is significant value to recording roles even without this features.

Another use-case for this feature is tracking how groups (identified by their roles) are using the application/cluster