A role defines what permissions a user account inherits. A role can be applied to a single user or a group of users. A user cannot do anything in the Puppet Enterprise Console until a role has been assigned to it.
I've a colleague called Terry who is a tester. To us colleagues, he is known as Terry the Tester. He is a genuinely nice bloke and an excellent colleague to work with. Let's imagine a scenario where Terry needs access to the Puppet Enterprise Console so that he can manage nodes in his test environment. He is not interested in managing the Puppet Enterprise (PE) user accounts. He just needs the ability to add nodes to the node group, trigger the Puppet runs, and access the Puppet reports via the Puppet Enterprise Console.