A user represents a person or service identity. A group collects users for ownership and administration. A role grants a named set of capabilities through the platform's access model. Group membership and role assignment are related administrative choices, but neither name alone proves what a user can do.
Where practical, assign appropriate roles to groups and manage membership instead of adding broad direct roles to every user. This makes responsibility easier to inspect and change. A deactivated user still needs attention in assignments and automation. Don't assume deleting a list favorite removes a privilege. Test the intended user's access after the change, including a negative case. The simulator keeps membership and role records separate so you can inspect both when diagnosing missing or excessive access.