SSO - User Roles or ACLs to differentiate access levels

You may also need to see Understanding groups and category permissions