A `User` Entity which has `Roles`, should I update the Roles in the repository code or in the business logic?

I am just new to this and I was reading about aggregates and roots and I got confused, big time!

I have a UserRepository in the DAL, and a Users in the BLL, the user was sent from a client (a web page for example) to the Users class for an Update operation. Should I check for new Roles in the in the business layer and then call a RolesRepository and add them or remove the deleted ones, or I should I do all of that in from within the UserRepository and keep the Users business logic purely for audit and other business stuff?