When we looked at tiers, we saw that the user pretty much gets one privilege level.  They get designated as an Administrator or an editor, or perhaps they get planted as a member of the Marketing Department.  With tiers, one size fits all, like it or not.

If you use roles, however, one user can have any number of role-based permissions assigned to what is now a user profile.  The following are the user profiles for six users:

System Users

	Curly	Curly Joe	Joe	Larry	Moe	Shemp
scream	x		x	x	x	x
cry	x	x	x	x		x
pull out hair				x	x
poke eyes	x				x
pinch nose					x
nyuk nyuk	x
soitenly	x
throw pies	x	x	x	x	x	x

Each 'x' in the matrix above represents a granted permission (where all possible permissions are listed in the left-most column).  Its obvious to see such a system is much more flexible than simple tiers.  Each user is given privileges pertinent to their roles in their organization.  You can mix and match who gets what as needed without having to force-fit users into a tier, or adjust the tier further open than you want it to accomodate a particular group of users. 

A more real-world example would contain permissions like Add, Edit, Delete, and View.  Or it would be refined still further, where you have a role for each action in each template, plus one for accessing the template itself.  Users would have to have the 'access' role just to get to the page in the first place.  From there the other roles in their profile would decide whether they could perform (or even see) various actions on the individual template itself, or were restricted just to look-but-don't-touch.

Examples of how to work roles into your code using AccessMonger Pro are available to registered users.