title: What's the difference between groups and roles?
body: <p>A lot of identity management implementations use roles in addition to groups. How are they different? So far I haven't found a compelling use case for separating the two. All the explanations I've read are vague and hand-wavey.</p>
  
  <p>Can you give a good example where having roles <em>and</em> groups are necessary?</p>