This image illustrates how roles, without an ACL, give the user the means to operate on database tables but not the permission to do so.