# ReferenceRoleAssignmentAnnotation

- Kind: `class`
- Package: [Aspire.Hosting.Azure](/reference/api/csharp/aspire.hosting.azure.md)
- Version: `13.5.1`
- Namespace: `Aspire.Hosting.Azure`
- Target framework: `net10.0`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/69db530a4816698cf1d5fa4557933e0ac4f127c6/src/Aspire.Hosting.Azure/ReferenceRoleAssignmentAnnotation.cs)
- Implements: `IResourceAnnotation`

Declares that any compute resource referencing the annotated resource should be granted [ReferenceRoleAssignmentAnnotation.Roles](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#roles) on the Azure resource [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target).

## Definition

```csharp
namespace Aspire.Hosting.Azure;

public sealed class ReferenceRoleAssignmentAnnotation
    : Aspire.Hosting.ApplicationModel.IResourceAnnotation
{
    // ...
}
```

## Remarks

This annotation is applied to a resource that "fronts" an Azure resource without being an [IAzureResource](/reference/api/csharp/aspire.hosting.azure/iazureresource.md) itself. For example, a Foundry hosted agent's node app is a plain compute resource, but invoking the agent requires the caller to hold a role on the owning Foundry account. The account is only a transitive dependency of a consumer, so `Azure.AzureResourcePreparer` 's normal reference walk -- which only acts on direct [IAzureResource](/reference/api/csharp/aspire.hosting.azure/iazureresource.md) dependencies -- cannot reach it.

When a compute resource takes a direct dependency on a resource carrying this annotation, `Azure.AzureResourcePreparer` folds `(Target, Roles)` into the same role-assignment path used for direct Azure references, so the consumer gets a managed identity and the corresponding role assignment on [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target) with no additional wiring.

## Constructors

- [ReferenceRoleAssignmentAnnotation(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/constructors.md#constructor-azureprovisioningresource-ireadonlyset-roledefinition) -- Declares that any compute resource referencing the annotated resource should be granted [ReferenceRoleAssignmentAnnotation.Roles](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#roles) on the Azure resource [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target).

## Properties

- [Roles](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#roles) : [IReadOnlySet<RoleDefinition>](/reference/api/csharp/aspire.hosting.azure/roledefinition.md) `get` -- Gets the set of roles that resources referencing the annotated resource should be assigned on [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target).
- [Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target) : [AzureProvisioningResource](/reference/api/csharp/aspire.hosting.azure/azureprovisioningresource.md) `get` -- Gets the Azure resource that resources referencing the annotated resource should be granted roles on.