In Splunk SOAR, roles serve multiple purposes, including granting users permission to access system functionality or restricting access to parts of the system1. Creating a new role is often necessary when there is a need to define a specific set of users who have access to a restricted app. This allows for granular control over who can interact with certain apps, ensuring that only authorized users can use them. While roles can also be used to manage access to labels, reports, and tags, the primary reason for creating a new role is typically related to controlling access to apps and their associated functionalities within the SOAR platform1.

References:

Splunk SOAR documentation on managing roles and permissions1.