Every action can be put on a role

Every button the server answers asks for a grant that Platform > Roles can give, or it is an administrator's, the person's own, or a routed approval.

Each button in a module asks for add, change, display or delete on a screen, and Platform > Roles shows a checkbox for it. A few things are never given to a role: the administrator's own controls (users, roles, settings, custom fields, impersonation and elevation approvals), a person's own things (their preferences, pins, saved views and tickets), and approvals routed to a named person, which only that person decides in My approvals.