...
The Role object is one part of the ACM security configuration. When user security is enabled (by enabling the option in the $Server object), the User objects and Role objects work together to define which user or group accounts can connect to ACM, which configuration changes they are allowed to make and which commands they're allowed to execute.
The Security section of the User Guide has further explanations and examples of security configuration concepts.
Role Tab
Modify Object Privileges
...
Use this section to control whether user's of the role have permission to delete specific types of objects. The permissions can be setup to allow deletion of specific object types and deny the rest, or to deny deletion of specific object types and allow the rest.
Configure Security
The Configure Security privilege allows non-admin users to create/modify/delete User and Role objects as well as enable/disable security.