The auditability is the point. Answering "who can delete customer records?" is a question about one role, not an inspection of every user account. That property is what compliance frameworks such as SOC 2 are looking for when they ask about access control.
Roles do have limits. When permissions start depending on context — the owner of a record, the region a user is in, the time of day — role proliferation follows, and teams end up with dozens of near-identical roles. That is the point at which attribute-based access control, which evaluates rules against properties of the user and the resource, becomes the cleaner model.
Codazz builds this in production — Authentication & SSO.