To put this in another way, when logged in a user is an Authenticated user, who cannot enter any course unless the course has guest access.
All Roles are context based, and Roles are applied in the current location of the user. All Roles confer specific capabilities in the context of where they are awarded. Roles, in their default settings, allow some users the ability to see things and prevent other users from seeing them. All Roles allow users different levels of interaction with the Moodle, Admins have full interaction, Guests have minimal or no interaction, if the Role is enabled or not.
Even that is technical now... mmm OK try this, no one can do anything unless the Role they have allows them to do it in the page they are on. Try it. Log in a dummy account that is only an Authenticated User and try to do something.
The three DO NOTS I have not always used with Roles,
1. DO NOT assign any non-Admin Role on the Front Page UNLESS you have a clear and specific reason to do so.
2. DO NOT give ANYONE a Role they do not NEED anywhere in the Moodle
3. DO NOT assign Roles in general locations e.g. Teachers in Categories.
Every time I have not followed these simple Rules, I have found lots of problems and gotten the odd bollocking for it. Don't dismiss the negative, btw, sometimes it can be better to work inside a clear negative boundary. Good luck.