Guys if you download the SCCM 2012 Toolkit, it includes the RBA Viewer which helps you build custom roles. This also helps you get an idea of what they can see in the console and what reports they can run. You still have to test workflow but it helps setting permissions in a better way than doing it from the console when setting up a role.