Flag roles have been replaced with standard user permissions

Access to a flag is no longer set in the admin settings for that flag. Instead, each flag exposes standard permissions which can be assigned to roles at Admin » Peoples » Permissions.

Because of this, the roles property of $flag objects has been removed. Access to a flag is now determined by standard user permissions.

Prior to Flag 3.x, the roles property was an array of role IDs in the flag object, and in turn saved in the serialized options in the database.

// Pseudocode only, for illustration.
$flag->roles = array(
  'flag' => array(1, 2), // Roles 1 and 2 may flag.
  'unflag' => array(2), // Role 2 may unflag.
);

If you are using Features or hook_flag_default_flags() to store flags in code, these will need to be updated. A flag's access configuration is no longer exported to code; you will need to export permissions separately.

When creating a flag programmatically, you should clear the static cache of flags before setting user permissions, as shown in this example from flag_bookmark_enable():

    $flag->save();

    // Clear the flag cache so the new permission is seen by core.
    drupal_static_reset('flag_get_flags');

    // Grant permissions.
    $permissions = array_keys($flag->get_permissions())
    user_role_grant_permissions(DRUPAL_AUTHENTICATED_RID, $permissions);