Roles aggregate permissions and responsibilities. Roles can be assigned to Persons or Groups. So instead of “Persons” being assigned permissions directly, the permissions are assigned to Roles and the roles are then assigned to Persons. It’s not uncommon for a Role to be associated with more than one permission or responsibility