Currently, RBAC uses get_kessel_relation_tuples to determine what relationships to add/remove when dual-write is active. Because it unnecessarily adds workspace parent-child relationship tuples, attempting to remove a role bound to a non-default workspace will also remove the parent-child relationship between the bound workspace and the default workspace,