WordPress Capabilities has always confused me, as you cannot allow granular access of certain roles to certain features.