One of the use case of Roles is to shield certain resources (endpoints) of services from Read/Write operations. For example, when we have OAuth & Rules enabled (in cd_ambient_conf.xml), only users in CD and implementer roles can perform GET/POST requests on content service.
The provider role is used when registering capabilities with discovery service (clientId=registration).
implementer role is similar to CD role except for the access to deployer endpoints.
Currently the shielding of resources are internal to CD services and only option available is enable/disable is completely. So, adding new roles is not currently supported.
This is documented here.