You can consider that a duty is a collection of security privileges, which it is; however, when designing the security model, we would do this the other way around – we would design the role with the required duties and then add the required security privilege to support the duty.
When extending the standard application, we often create new forms and therefore new menu items. The security privilege may, therefore, be required for an existing duty. In this case, we would create an extension of the required duty. To do this, we would right-click on that duty, and choose Create extension, remembering to change the .extension suffix to one that relates to the model we are developing: application elements belong to a model, and models belong to a package. Then, we can just drag the privilege from the project onto the duty. This same process would be followed should we wish to add a new duty and a standard role – or an existing role in a different package.