roles vs. claims vs. policies in Identity Server

This suggests that roles include both users and functions (things one may do) while a user is made up of claims. A policy is an authorization frontdoor to see if you may go forward.