I've either gone to their workstation or remoted in to make those specific changes. Alternatively, you could give them their own role that is a copy of an existing role. It's not scale-able though, because then you'll have to "manage" multiple roles