What is a "role" in this model, where is it defined, and what dangers does it manage?

A role is a "bag of rights" assembled in an identity system (IAM) — grouping functional rights so users can be granted a job function in one step, while guarding against over-privilege.

Individual functional rights are wired into protocols, but roles bundle them and are assembled in an IAM (Identity and Access Management solution) such as Keycloak or Azure Entra. So "Customer Success" might bundle the rights to "Review activities" and "Approve onboarding". This split — rights in code, roles in the IAM — is what makes user management flexible without touching the running system. Two principles keep it safe:

• Least privilege — grant only the minimum access needed to do the job.
• Separation of duties — divide responsibilities across roles so no single person has too much control.

The danger to avoid is the "super user": combining wide access scope with elevated rights creates unintended all-powerful accounts, a serious security and compliance risk. Pairing broad scope with tight rights (and vice versa) counters it.

Go deeper:

• Identity management (Wikipedia) — where roles live: the IAM layer (Keycloak, Azure Entra) that grants job functions without touching the running system.