Check capabilities, never roles. current_user_can('manage_options') survives custom roles; current_user_can('administrator') breaks the first time someone adds a new admin-equivalent role.
Use granular meta-capabilities like edit_post with a post ID — they invoke the capability mapper, which respects ownership and post status.
Add custom capabilities sparingly. Each one is a string the rest of the codebase has to remember; capability sprawl is real.