I would like to filter a SOAP request for AccountUsers where the role equals APPROVER. Here's the SOAP envelope without a filter:

      <?xml version="1.0" encoding="utf-8"?>
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
         <soapenv:Header>
            <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
               <wsse:UsernameToken wsu:Id="UsernameToken-32259181" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                  <wsse:Username>user</wsse:Username>
                  <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">pass</wsse:Password>
               </wsse:UsernameToken>
            </wsse:Security>
         </soapenv:Header>
         <soapenv:Body>
            <RetrieveRequestMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
               <RetrieveRequest>
                  <ObjectType>AccountUser</ObjectType>
                  <Properties>Name</Properties>
                  <Properties>Email</Properties>
                  <Properties>Roles</Properties>
               </RetrieveRequest>
            </RetrieveRequestMsg>
         </soapenv:Body>
      </soapenv:Envelope>

This returns all users and their roles (snippet below)

        <RetrieveResponseMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
            <OverallStatus>OK</OverallStatus>
            <RequestID>668aec01-1022-406e-82d5-b446ffd89beb</RequestID>
            <Results xsi:type="AccountUser">
                <Client>
                    <ID>10699999</ID>
                </Client>
                <PartnerKey xsi:nil="true" />
                <ID>10656984</ID>
                <ObjectID xsi:nil="true" />
                <Name>Sam Sample</Name>
                <Email>email@companylcom</Email>
                <Delete>0</Delete>
                <Roles>
                    <Role>
                        <Client>
                            <ID>10659964</ID>
                            <CreatedBy>34649</CreatedBy>
                            <ModifiedBy>34649</ModifiedBy>
                            <EnterpriseID>10659964</EnterpriseID>
                        </Client>
                        <PartnerKey xsi:nil="true" />
                        <CreatedDate>2013-12-27T13:03:33.32</CreatedDate>
                        <ModifiedDate>2013-12-27T13:03:33.32</ModifiedDate>
                        <ObjectID>68057e44-f76e-e311-987e-0025b3d7f36a</ObjectID>
                        <CustomerKey>APPROVER</CustomerKey>
                        <Name>Add Users to Account</Name>
                        <Description>Add Users to Account</Description>
                        <IsPrivate>false</IsPrivate>
                        <IsSystemDefined>false</IsSystemDefined>
                    </Role>

I would like to filter this to only include results where Role.CustomerKey equals APPROVER but I can't figure out what this simple filter would be. Is someone able to provide an example?