Every role in Shokoofa: what it allows in each app, whether it needs two-step sign-in, who may assign it and which roles cannot be combined.