You can consider that a duty is a collection of security privileges, which it is; however, when designing the security model, we would do this the other way around--we design the role with the required duties, and then add the required security privilege to support the duty.