# ReferenceRoleAssignmentAnnotation Constructors

- Package: [Aspire.Hosting.Azure](/reference/api/csharp/aspire.hosting.azure.md)
- Type: [ReferenceRoleAssignmentAnnotation](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation.md)
- Kind: `Constructors`
- Members: `1`

Declares that any compute resource referencing the annotated resource should be granted [ReferenceRoleAssignmentAnnotation.Roles](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#roles) on the Azure resource [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target).

<a id="constructor"></a>
<a id="constructor-azureprovisioningresource-ireadonlyset-roledefinition"></a>

## ReferenceRoleAssignmentAnnotation(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)

- Name: `Constructor(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/69db530a4816698cf1d5fa4557933e0ac4f127c6/src/Aspire.Hosting.Azure/ReferenceRoleAssignmentAnnotation.cs#L32-L42)

Declares that any compute resource referencing the annotated resource should be granted [ReferenceRoleAssignmentAnnotation.Roles](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#roles) on the Azure resource [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target).

```csharp
public sealed class ReferenceRoleAssignmentAnnotation
{
    public ReferenceRoleAssignmentAnnotation(
        AzureProvisioningResource target,
        IReadOnlySet<RoleDefinition> roles)
    {
        // ...
    }
}
```

## Parameters

- `target` ([AzureProvisioningResource](/reference/api/csharp/aspire.hosting.azure/azureprovisioningresource.md))
  The Azure resource that referencing resources should be granted roles on.
- `roles` ([IReadOnlySet<RoleDefinition>](/reference/api/csharp/aspire.hosting.azure/roledefinition.md))
  The roles that referencing resources should be assigned on `target`.

## Remarks

This annotation is applied to a resource that "fronts" an Azure resource without being an [IAzureResource](/reference/api/csharp/aspire.hosting.azure/iazureresource.md) itself. For example, a Foundry hosted agent's node app is a plain compute resource, but invoking the agent requires the caller to hold a role on the owning Foundry account. The account is only a transitive dependency of a consumer, so `Azure.AzureResourcePreparer` 's normal reference walk -- which only acts on direct [IAzureResource](/reference/api/csharp/aspire.hosting.azure/iazureresource.md) dependencies -- cannot reach it.

When a compute resource takes a direct dependency on a resource carrying this annotation, `Azure.AzureResourcePreparer` folds `(Target, Roles)` into the same role-assignment path used for direct Azure references, so the consumer gets a managed identity and the corresponding role assignment on [ReferenceRoleAssignmentAnnotation.Target](/reference/api/csharp/aspire.hosting.azure/referenceroleassignmentannotation/properties.md#target) with no additional wiring.