User permissions and roles – allow both or just roles?

Does it make more sense to only set permissions on roles, and the give roles to users, or should the application allow specifying user roles AND permissions?

I'm not sure if allowing both to be set on users is overkill.