It sounds like you are using MSSP organizations? If so, currently you must use roles by assigning groups. Assign the roles to the groups and then assign users to the groups. With the next version of Resilient this is enforced more strictly so we recommend you move to that approach.
At some point in the future we will support the direct role/workspace assignment to users, but for now Groups are required.
------------------------------
Ben Lurie
------------------------------