Security is based on user Roles and Groups. A User interface is offered to define Roles. Once roles are defined, it is as simple as using Facebook to allow or disallow a list for any user. Defining roles required for Administrator Role and skills.
Watch Video: Understanding Role-Based Access Control.