Common role combinations

Because an employee can hold several roles and all of them share one scope, most real profiles are built by combining two or three roles rather than looking for a perfect single match.
Real profile
Roles
Scope
Operations manager who also views reports
hub_manager + 
report_viewer
Customer, or explicit by store
Operations manager who manages alarm thresholds
hub_manager + 
alarms_config_manager
Customer, or explicit by store
Operations manager who also runs the dispatcher
hub_manager + 
dispatcher_manager
Customer, or explicit by store
Shift operator who also views reports
hub_operator + 
report_viewer
Explicit — their stores
Store manager with access to reports
branch_manager + 
report_viewer
Explicit — their stores
Brand manager who doesn't operate orders
employee_manager + 
polygon_manager + 
third_party_manager
Explicit — brand
Delivery zone technician
polygon_manager
Explicit — brand
Management, data only
report_viewer
Customer
Full administrator
admin
Customer
Why 
hub_manager doesn't include the dispatcher
hub_manager deliberately focuses on hub operations. If your operations manager also needs the dispatcher, the scheduler or third-party carriers, assign 
hub_manager + 
dispatcher_manager.
Each role keeps its own area of responsibility, and the permissions combine automatically. This is preferred over widening 
hub_manager, because it keeps the two responsibilities visible and separately removable.
Rules of thumb
Combine roles, don't request new ones. Most needs are a combination that already exists. A new role definition requires a request to the development team — see Requesting a new or changed role.
Roles only ever add. Assigning a second role never reduces what the first one granted, and never widens what data is visible. Only scope controls that.
Use exceptions for the one-off case. If a profile matches an existing role except for a single ability, keep the role and add an individual grant or deny — see Individual permission exceptions.