gistfile1.txt

def roles_update_permitted?(user)
  new_roles = params.fetch(:staff, {}).fetch(:roles, []).map do |role|
    role['type']
  end

  (new_roles - accessible_roles).empty?
end

request payload

{
   "staff" : {
      "firstName" : "Hip",
      "id" : 12,
      "lastName" : "Hop",
      "roles" : [],
      "email" : "hiphop@gmail.com",
      "country" : "UK"
   }
}