It helped me to copy the existing system generated roles and use those as a template for my own role generation. For example, I wanted to have a role that could view all configuration and device information for a select group of devices, but could not write any changes to the devices. The HelpDesk role almost does this but even some of the performance reporting was unavailable to them. The HelpDesk and Network Operator roles combined had just a bit too much authority, but I started with those two roles as a template and then removed configuration capabilities from the new role and had my own role with View only capability. It's a bit time consuming, but much easier if you start with the roles they give you.
