Roles are assigned to Access Controls, and also to groups. Users are added to groups and then the roles are inherited by the user. This is the recommended way to assign roles to users.
That being said contracts vary from customer to customer and often a user with any role has a cost associated with it. So it is important to understand how roles are assigned to users.