I typically set the constraints at the database level, bypassing sqlobject. You can take this route and catch the odd exception that might occur when you violate the constraint with a new role, or your code needs to check to see if the role already exists for the user before you add the role.
I don't believe you can set up an explicit constraint in sqlobject on the related joins.
