In the admin console you can manage realm roles from the "Roles" link in the menu on the left hand side. Further you can manage roles for a client (service) by finding the client first, it then has a tab for roles. For clients (front-ends) there's a scope tab that let's you control what roles the client is allowed to obtain.
Once you've done that a client that receives a token will contain the roles the user and client is permitted to have. When this token is sent to the service the adapter then checks if the token contains the required roles. The service can either use realm roles (global roles) or roles specific to itself (client roles, which is enabled by setting use-resource-role-mappings to true in the keycloak.json file for the service).
Does that answer your questions?