How to Structure a New Role/Capability Scheme?

I have a situation where I need users to be flagged as “Instructors” on a site. That role should basically be whatever the user’s current role is with the added capability to see comments from students on a custom post type called “Questions”.

I’m struggling with how to implement this conceptually. Should I just add a new capability and have it assigned by itself, or should I add it and assign it to a new role as well?

[edit]From kaiser’s resources, it appears I should just add the custom capability and assign it to users on an individual basis, perhaps from my own plugin’s options/settings admin page, as opposed to creating a specific role[/edit]

What happens if I change the user’s role to something else (say from Admin to Editor) but still want them to have that capability? Is this a fairly easy thing to program in a custom plugin (which is where I’m doing all of this from), or is this going to be a monumental undertaking?

The following are my main questions;

1. What is the underlying logic when switching user roles from one to another?

2. Do custom capabilities that were assigned carry over when switching user roles, or does the new role assignment overwrite anything else?

WordPress capability system roughly works like the following:

• Capabilities can be attached to users or roles
• Roles can be attached to users
• Roles are a flat system, so there is nothing overruling something else
• Role names are capabilities as well

Keep in mind that role names are capabilities as well, but you shouldn’t check against them. The same goes for the deprecated level-0 until level-9 caps.

In theory WordPress supports multiple roles per user – something that is extremely convenient as you can add and remove Capability packages summed under role names. It just has no UI and isn’t built in. Oh, and there’s (afaik) no plugin that delivers that.

So: yes assigning capabilities users is OK. But keep in mind that this can quickly can get a maintenance nightmare. In most cases it’s better (not perfect) to just grab a role, copy its capabilities over to your new role and add the new role to a user. When you then want to change something, just exchange to role for all users that need to have a new set of caps.

Note: This is my opinion. Others might have a different one when it comes to what is a nightmare and what not 🙂