Database modelling: How to ensure that users don't have roles in different groups?

I've modelled the entities User, Role and Department in a hierarchical order (Users can have multiple roles, but each role belongs to exactly one department). Every user has an initial role, e.g. Employee of Deparment A.

How can I ensure on db-level that users can't be assigned to another department B?

Is a relation between user and department necessary in this case?

via Chebli Mohamed