The people who sign in to the admin panel, and what each of them can do.
Access is the sum of two things
A user's access comes from their role. Any permissions set on the user themselves are added to it.
Per-user permissions never subtract from the role. To take an ability away, change the role or edit the role itself.
Permissions are named after their module
Every permission has the shape <module>.<action>. That makes it clear from the name alone what a permission governs, and lets a whole module be granted at once.
System roles cannot be touched
Two roles — the default role and superadmin — cannot be deleted or altered. The default role is the fallback every new user lands in, and superadmin is the role that administers the system itself.
Nobody can reach above themselves
An admin who is not a superadmin cannot edit a superadmin account, change its password, or grant superadmin-level permissions to themselves or anyone else. Those attempts are refused rather than quietly having no effect.
Access changes take effect at once
Changing a user's role or permissions applies immediately; nobody has to sign out and back in.