Roles, both normal roles and restricted roles, are assigned in two ways:

• when inviting users to the members group of a workspace or other object
• explicitly for a user using  Access    Assign Role  

The former case allows to assign roles not only to users, but also to groups of users. This may lead to multiple roles a user holds: invite two groups of users which both contain a certain user.

The latter case is only possible for individual users, not for groups of users. It may be used to re-assign a role to a particular user who was invited as member of another group (the group being invited in another role).

What roles can be assigned?
When inviting users to a members group, any role which is defined globally or in that object's scope may be assigned to individual users or to groups of users. This includes normal roles like Manager, Member, etc., and restricted roles like Anonymous Member, but not system-defined roles, e.g. owner or creator. The latter roles are computed by the system.