There are different roles with different permissions. You would just give the role that has the permissions required 🙂