Custom roles are not possible in Express, from the guide:
The following activities are available with BlackBerry Enterprise Server only (not with BlackBerry Enterprise Server Express): |
- Set up and manage the high availability architecture
- Wirelessly deploy BlackBerry® smartphones
- Set custom administration roles
So you need the full BES to create new roles or edit existing ones.