Roles and Permissions
The permissions assigned to a user role determine the Liferay applications and resources they can access and use. You can scope each role to an instance, Site, Organization, Asset Library, or Account. Depending on the scope, a role can have different permissions assigned. Every permission also has its own scope, which determines the applications and resources that are accessible and available. See Understanding Roles and Permissions for more details.