honestly don't know why it's adding roles for all realms, as the admin console is only displaying one realm at a time. So perhaps this can be relatively easily resolved by the whoAmI endpoint returning only roles the admin has for the currently selected realm