Nearly all enterprise and large scale systems need authentication and authorization for using the underlying system resources. The key model and probably the most popular one is RBAC.
The central idea in RBAC is
Permissions (or Permission sets) are associated with Roles.
Users (or User Groups) are associated with Roles.
A permission is basically an approval of an operation on one or more objects.