Can privileges be assigned on top of roles?

Yes, you may assign extra individual privileges to users who also have a user account role assigned to them. For example, let's say one of your users is assigned to a customer service role—but because she is a supervisor, she needs a few additional permissions. In this case you could either A) create a new supervisory role or B) add the individual privileges the user needs beyond the standard role.