Jerry, yes, you're right.
Let me point you to pretty good explanation right here: Logon is not possible because you have not been assigned to a business role; please contact your system administrator
So business role determination is taken in three steps (you can observe them in class CL_CRM_UI_PROFILE_DETERM method LOAD_PROFILES):
1. From user's parameter CRM_UI_PROFILE (method LOAD_FROM_USER_PARAMETER);
If CRM_UI_PROFILE = * then the user needs to have S_DEVELOP authorization object with OBJTYPE = 'DEBUG' (debug authorization).
2. If not found on previous step: From organizational management (method LOAD_FROM_ORG_MANAGEMENT)
3. If not found on previous steps: Based on PFCG roles (method LOAD_FROM_PFCG_ROLE);