Function role_for_token 

pub fn role_for_token(
    claims: &HashMap<String, Value>,
    headers: &[(&str, &str)],
) -> TokenRole

Settle which role a verified token speaks as, given what the caller asked for.

A token that allows more than one identity carries both x-hasura-default-role – who the caller is when it asks for nothing – and x-hasura-allowed-roles, the list it may ask for instead. The asking is done with an X-Hasura-Role header, and the list is what makes reading that header safe: it sits inside the signature, so a caller can choose among the identities it was issued and cannot add one.

This is the one place a header names a role without the admin secret beside it, and it is safe for that reason alone. A token with no list allows only the role it already names – an absent list is not permission to be anyone.