diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 53d937554..beb3d589e 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -244,6 +244,47 @@ RSpec.describe User, type: :model do
       end
     end
 
+    context "when the user is in non staging environment" do
+      before do
+        allow(Rails.env).to receive(:staging?).and_return(false)
+      end
+
+      context "and the user is in the staging role update email allowlist" do
+        before do
+          allow(Rails.application.credentials).to receive(:[]).with(:staging_role_update_email_allowlist).and_return(["example.com"])
+        end
+
+        context "when the user is a data provider" do
+          it "cannot assign roles" do
+            expect(user.assignable_roles).to eq({})
+          end
+        end
+
+        context "when the user is a data coordinator" do
+          let(:user) { create(:user, :data_coordinator) }
+
+          it "can assign all roles except support" do
+            expect(user.assignable_roles).to eq({
+              data_provider: 1,
+              data_coordinator: 2,
+            })
+          end
+        end
+
+        context "when the user is a Support user" do
+          let(:user) { create(:user, :support) }
+
+          it "can assign all roles" do
+            expect(user.assignable_roles).to eq({
+              data_provider: 1,
+              data_coordinator: 2,
+              support: 99,
+            })
+          end
+        end
+      end
+    end
+
     context "when the user is in staging environment" do
       before do
         allow(Rails.env).to receive(:staging?).and_return(true)