To authorize a technician to patch workstations, you need to activate 3 options in the roles (Manage Patch and IT Automation, Manage Scripts and Server Remote Manage).
This way of managing roles makes no sense and represents a security flaw.
In my opinion, enabling the "Manage Patch and IT Automation" option alone should allow a technician to manage patches on workstations (with Manage Scripts and Server Remote Manage disabled).
I don't want a novice technician to be able to administer the servers, let alone the scripts on which we often spend long hours.
I hope that my request will be supported by the community ;-) and that you will correct this inconsistency as soon as possible.
Ticket support N° 426390 for more information
Sincerely