def METHOD_NAME(ri, oc_map):
    gqlapi = gql.get_api()
    roles: list[dict] = expiration.filter(gqlapi.query(ROLES_QUERY)["roles"])
    users_desired_state = []
    # set namespace to something indicative
    namespace_cluster_scope = "cluster"
    for role in roles:
        permissions = [
            {"cluster": a["cluster"], "cluster_role": a["clusterRole"]}
            for a in role["access"] or []
            if None not in [a["cluster"], a["clusterRole"]]
        ]
        if not permissions:
            continue
        service_accounts = [
            bot["openshift_serviceaccount"]
            for bot in role["bots"]
            if bot.get("openshift_serviceaccount")
        ]
        for permission in permissions:
            cluster_info = permission["cluster"]
            cluster = cluster_info["name"]
            if not oc_map.get(cluster):
                continue
            # get username keys based on used IDPs
            user_keys = ob.determine_user_keys_for_access(cluster, cluster_info["auth"])
            for user in role["users"]:
                for username in {user[user_key] for user_key in user_keys}:
                    # used by openshift-users and github integrations
                    # this is just to simplify things a bit on the their side
                    users_desired_state.append({"cluster": cluster, "user": username})
                    if ri is None:
                        continue
                    oc_resource, resource_name = construct_user_oc_resource(
                        permission["cluster_role"], username
                    )
                    try:
                        ri.add_desired(
                            cluster,
                            namespace_cluster_scope,
                            "ClusterRoleBinding",
                            resource_name,
                            oc_resource,
                        )
                    except ResourceKeyExistsError:
                        # a user may have a Role assigned to them
                        # from multiple app-interface roles
                        pass
            for sa in service_accounts:
                if ri is None:
                    continue
                namespace, sa_name = sa.split("/")
                oc_resource, resource_name = construct_sa_oc_resource(
                    permission["cluster_role"], namespace, sa_name
                )
                try:
                    ri.add_desired(
                        cluster,
                        namespace_cluster_scope,
                        "ClusterRoleBinding",
                        resource_name,
                        oc_resource,
                    )
                except ResourceKeyExistsError:
                    # a ServiceAccount may have a Role assigned to it
                    # from multiple app-interface roles
                    pass
    return users_desired_state