Typically, you would assign one of your organization’s defined roles to a group or user. If you want to create a special role for a group or user, you can create a custom role (for details, see Assign a Role to a Group and Assign a Role to a User).
A user or group may also be automatically assigned a custom role by Blue Relay if the allowed actions they’ve inherited don’t match a defined role. For example, let’s say a user is assigned a role which only allows them to view items. This user is a member of the Sales group (which is allowed to create items) and the Testing group (which is allowed to modify specific items only). The combination of allowed actions from the user’s role, the Sales group role, and the Testing group role doesn’t match any of the organization’s defined roles, so the user has a custom role.