Roles tl;dr
The channel role determines which permissions the channel itself grants. The contact role allows you to grant further permissions to connections (but only connections), though it cannot revoke permissions granted by the channel role.
Every channel always has a default contact role, which varies depending on the channel role. For a channel with no connections, this contact role has no effect, as it only applies to connections. You can also create your own contact roles to grant even more or different additional(!) permissions to specific connections.
Here is a table providing an overview of the default channel and contact roles:
