Different clients manage the issue of holding multiple roles in different ways. Some choose to map out all the role permutations (e.g., Role = student/staff) and the permissions associated with each, just as you described in your comment. Others take a more modular approach and assign users to multiple roles (e.g., student AND staff) and make the roles additive. The second approach reduces the total number of roles to manage,allows a more modular approach, and reduces the upfront effort of thinking of all the possible permutations. That said, you also have less control of the permissions for each combination because they are managed at a higher level (e.g., a general staff role plus a general student role defines the full set of permissions) instead of defining a more discreet set of entitlements for each role.