What are the two options for creating SolMan roles, and which has the least maintenance?

1. Copy the SAP composite + all single roles into the customer namespace, then add customer-object authorizations (e.g. after copying SMCR, add ZMCR).
2. Create just one single role for your custom objects and directly assign SAP-provided roles.

Option 2 has the least maintenance (no copying 60+ SAP single roles). SAP supports direct assignment, but some companies' policies forbid assigning SAP roles directly to end users.