I wanted certain teachers to be able to see hidden courses in hidden categories. I tried two methods using roles. The two methods should have yielded equivalent results, but only one worked.

Method 1: modify the legacy role Teacher (this works)

login as admin
Site administration -> Users -> Permissions -> Define roles
edit the Teacher role
allow "See hidden categories"
allow "View hidden courses"
any Teacher who now logs in can see hidden categories and courses

Method 2: create a new role that inherits from Teacher (this does not work)

login as admin
create a new role CanSee inheriting from legacy role Teacher (editing)
allow CanSee to see hidden categories
allow CanSee to see hidden courses
in site context, assign user X to role CanSee
login as user X – cannot see hidden categories and courses