This seems to be a common misconception. You do not need a role for every user. You can assign session variables, at least in Postgres, and use them in your policies.