Custom roles are powerful but easy to overuse. Three signals tell you when a custom role is the right answer, and the cloning pattern that keeps your role catalog manageable.