It links one member in one of the role bindings From my experience, in all IaaS that I have used, managing full bindings directly never ends well