It was checking when the pair was created, but the role may have already changed when the request is sent.