When ever you define the role, you could grant access to that at the time of user creation or alter user time or grant. You use the grant mostly to give restricted access in specific. On the other hand if you enclose in the user level, it would be one of his default permission setups. I hope this would give you an idea.

Sam