The check_roles endpoint is currently implemented by using a RelationApiDualWriteHandler for all roles. This is problematic because that class cannot handle system roles and because it will create BindingMappings while computing the relations to add (which is something we do not want for this endpoint).