Roles apply within the current domain and any of its children. Because child domains are essentially contained within parent domains, if a user is given, for example, Operator role for a parent domain, that role also applies to all children of the parent. Note that additional roles can be granted to the user at the child level, but a role granted at a parent cannot be overridden at a child level. Using the example above of a user granted an Operator role at the Root Admin Domain level, suppose you create a child admin domain. The user with the Operator role inherits that role at the child level; however, if you wanted the user to have Super User status at the child level, you can assign the Super User role within that child domain.
Trellix IPS roles provide a granular level of access within the system. This enables you to provide very limited responsibilities to a number of individuals, or to assign a single user multiple roles so the user can accomplish multiple administrative tasks (for example, grant System Administrator and Security Expert roles) within the system.