Thanks for the suggestions! I think keeping all the enforcement logic in the UDF will work for me for now, since I can at least compose the logic in my JavaScript migrations that create the UDF.
If identity doesn’t work for role predicates assigned to UDFs, it would be really good to document this. I spent many hours on something that I thought should work and Fauna highlights as a feature. It sounds like I’m not the first person to struggle with this either, if you read kgoggin’s last message in this thread.