In short
Permissions set by a person's role, not one person at a time. An owner, a staff member and a contractor each see and do different things.
Role-based access gives each role a set of permissions, and each person a role. The app checks that role before it shows a record or takes an action.