To be granted to a resource, the user (%Name;) must be a member of a self-service user role that has "Can receive resources" ...