I attempt to give it to the client when setting them up. At the top of the three permission columns is where put the role title.
Of course, role permissions overwhelm even the experienced users, so odds are the new user to MAS is going to be practically helpless. But it conveys the understanding that a lot goes into setting up roles and that they need to be an active participant even if I walk them through the process.
My motto is also ""when in doubt, leave them out"". A user will always tell you if they can't do something. They usually don't say a word if they can access payroll when they shouldn't be.