Hi Hira
My approach is roles should be mitigated as there is a chance that the generated profile could change. Profile mitigation applies to single non-generated profiles.
Or do you mean mitigate the user or mitigate the role/profile?
Regards
Colleen