How are SolMan roles structured, and why does copying SAP roles into your namespace add upgrade work?

Single + composite roles by functional area and access level (read-only/execute/admin). Three user types: administrator (mandatory config), configurator (tool-specific config — a ChaRM-config person can't touch application operations), user (end-user role templates).

Copying SAP roles into your namespace adds upgrade work because composite roles are continuously updated each SP stack → every upgrade requires planning remediation effort.