Roles determine what actions users are allowed to perform.
How to create a user.
While Teams determines the inventory a user will have access to, Roles determines what actions that user will be able to take to that inventory.

Creating a New Role

To create a role, go to Roles under the Users section, then click "new" in the upper right corner. Start by giving your role a Name and description of your choice.
You can then choose application, role type and scope to design your role. You will find a deeper explanation of all choices in this Google Worksheet:
If you want to create a user that has no network permissions, you can create a network role where all permissions are unchecked (and call it for instance "no permissions"). This way, when you add a user with this network role, they cannot do anything to the network.
In Admin > Network you will be able to determine show or hide sections of the user interface that users do not have permissions to edit.

Typical Role Configurations

In order to make it easier to create new roles, here are some typical role configurations that may help you along.
Marketplace Advertiser: an agency or advertiser that should be able to buy inventory from some or all publishers.
Marketplace Publisher: a publisher that should be able to sell its inventory through your marketplace.
More role configurations will soon be added.