Part 3 defines:
A Role is a function assumed by a Client when it accesses a Server. Roles are used to separate authentication (determining who a Client is) from authorization (determining what the Client is allowed to do).

The name or Part 18 is 'User Authentication'.
The main chapter in Part 18 is called 'User Authentication Model'

But User Authentication is covered by User Tokens.
Is Role not more part of User Authorization?