Instead of trying to analyse that all roles are bound in the same method and only in that method. Enforce that all roles are bound in the constructor (or not at all) by use of the readonly modifier.
A code issue that tests that all readonly fields are set could be applied afterwards