Okay I got it to work using $plan.roles$ after modifying the body a bit after checking that box.
Now I am running into an issue with the Add Entitlements operation because the API required a PUT operation to update accounts. I think I need to write a BeforeOperation rule to account for this, but that is outside the scope of this thread.
Thanks Nathan for calling out that option, very much appreciated!