Dynamic RLS uses the identity of the signed-in person, via USERPRINCIPALNAME(), to filter data from a mapping table between users and scopes. A single role is then enough for all users, instead of one role per scope.
Example
[Email] = USERPRINCIPALNAME()