The text on roles discusses sessions but leave no mention of Session-less.

Add.

For session-less service calls the role determination process shall happen with each service call.

to this paragraph:

When a Session is created, the Server must determine what Roles are granted to that Session. This specification defines standard mapping rules which Servers may support. Servers may also use vendor specific mapping rules in addition to or instead of the standard rules.