User.HasRole returns True if no roles assigned

If the current folder does not have any roles assigned, and also does not inherit any role assignments from one of it's parents, the User.HasRole method will return True for any query. This behavior is by design: role based security is disabled if there are no roles assigned. To enable role based security and let User.HasRole return predictable results, always make sure there is at least one role, any role, assigned to the root of the vault. PH-0009 Roles and Privileges