Custom entity custom cache tags
To add a cache dependency on user roles you don't need a cache tag, but a cache context user.roles.

However, you rarely need this context, because there is already a default render context for the hashed user permissions user.permissions, set in the container variable required_cache_contexts, which is applied on all render arrays: 

default.services.yml:

parameters:
  renderer.config:
    # Renderer required cache contexts:
    #
    # The Renderer will automatically associate these cache contexts with every
    # render array, hence varying every render array by these cache contexts.
    #
    # @default ['languages:language_interface', 'theme', 'user.permissions']
    required_cache_contexts: ['languages:language_interface', 'theme', 'user.permissions']