Where do workspace roles come from, and why can’t I delete one?

Roles are collected from a Roles section in saved Draft specs — you do not create them on the catalog page. Operations show Primary / Secondary tags. Delete only after you remove every reference, save, then delete. Add or rename a role by editing the spec.