As discussed in https://github.com/symfony/symfony/pull/20801#issuecomment-265688920 we're ready to deprecate the use of objects as security roles and start using simple strings as roles.