A person sees a menu when their role has it, and may use a screen when their role has its permission. The licence decides what the company can give any role, and the branch decides which documents the person works in.
A role holds a set of permissions. A permission that opens a screen also gives the role that screen's menu, and the menu groups above it (Choose what a role may open and do).
3
The user
Who
Administrator
Where
User
What changes
A user has a main role and may have more. With several roles the user gets everything any of them gives: the menus and the permissions of all the roles together (Add or change a user).
A permission is a named right such as seeing the list of users, adding a user or deleting a branch. It works in three places:
The menu. The role's menus are read when the user signs in. An item the role does not have does not appear.
The page. Opening a screen the role has no permission for shows Sorry, you don't have access to this page. with the button Back to home.
The buttons. A screen hides or switches off an action the role may not do (for example Add without the permission to create).
When a change reaches the user
The menu and the screens are read once, when the user signs in. After you change a role's permissions or a user's roles, ask the user to Sign out and sign in again.
Editing a role, a user or a branch (the edit form, not the permission list) also warns the people it affects: they see a short warning and are signed out after a few seconds. See Users: the list, locking and deactivating.
One of my roles has a permission and another does not. Which wins?
Neither takes anything away. A person gets everything that any of their roles gives. To take something away, remove the role from the person, or clear the permission on that role (Choose what a role may open and do).