User roles are a way to create user profiles, which can easily be assigned to users to manage their access rights. Each role can be assigned the same attributes as a regular user: a level, control flags and groups to access media. The roles can then be assigned to users, passing on their settings to the users.
When using roles instead of individual access rights, it's easy to manage large sets of users. By having a few default roles, like one for internal employees, it's always just a small edit to update the settings for the entire group.
The user roles don't replace groups or control flags. It is still necessary to set up groups for regular users and uploaders to grant them access to specific folders.
A user can only be assigned a single role. This role however, can contain multiple user groups and control flags. A role can be any level, including administrator or media manager. Please note that after assigning a role to a user, you can no longer manually change the settings for that single user.
For more information regarding the user levels, please read this article.