diff --git a/specification/security/_types/RoleMapping.ts b/specification/security/_types/RoleMapping.ts
index 9f505418a9..86747c94eb 100644
--- a/specification/security/_types/RoleMapping.ts
+++ b/specification/security/_types/RoleMapping.ts
@@ -25,7 +25,9 @@ import { RoleTemplate } from './RoleTemplate'
 export class RoleMapping {
   enabled: boolean
   metadata: Metadata
-  roles: string[]
-  rules: RoleMappingRule
+  // Exactly one of roles or role_templates should be set
+  roles?: string[]
+  // Exactly one of roles or role_templates should be set
   role_templates?: RoleTemplate[]
+  rules: RoleMappingRule
 }
diff --git a/specification/security/put_role_mapping/SecurityPutRoleMappingRequest.ts b/specification/security/put_role_mapping/SecurityPutRoleMappingRequest.ts
index d0121ac8d7..fcf149962d 100644
--- a/specification/security/put_role_mapping/SecurityPutRoleMappingRequest.ts
+++ b/specification/security/put_role_mapping/SecurityPutRoleMappingRequest.ts
@@ -37,7 +37,9 @@ export interface Request extends RequestBase {
   body: {
     enabled?: boolean
     metadata?: Metadata
+    // Exactly one of roles or role_templates must be specified
     roles?: string[]
+    // Exactly one of roles or role_templates must be specified
     role_templates?: RoleTemplate[]
     rules?: RoleMappingRule
     run_as?: string[]