[Zope] Guru Meditations on roles, __roles__ etc?

Would someone in the know care to give a brief introduction to the way in which available roles are presented in the "Security" tab of items which inherit from SecurityManager. I would like the roles available to be culled from our LDAP database (via a LDAPLoginAdapter). Is acl_users automatically asked for any roles it has? Or is this the responsibility of the containing folder/product? Thanks in advance for any advice, John Ziniti