Multiple Roles in WordPress and CiviCRM access rights
I did testing today on this and from what I can tell, when setting a second user role in WP CiviCRM will read the security settings from both roles.  It is optimistic security in that if one of the user roles has 'administer CiviCRM' and the other does not, the user can administer CiviCRM.