Authorizations are granted based on a user's access group, not the role. The most permissive role in the access group determines the level of authorization for the access group.
Even if an access group is not referenced by any operator ID instance, it is still required for security configuration.