Role is a subtype of group – this is why see you them in the results of your query. Groups are used in acls and workflows. Roles are used to filter our application features. For example, if set the client_capability=consumer for a user (consumer is a default role), the edit feature is disabled