Currently dependencies between records, such as roles, documents, tags, or users, are only fully established when a process is published. There should be an admin configuration setting that allows the site's promaster to determine if the dependency (and related blocking actions) should be established on process save or process publish.