User permissions and access settings are specified in profiles and permission sets. Every user is assigned only one profile, but can also have multiple permission sets. When determining access for your users, use profiles to assign the minimum permissions and access settings for specific groups of users. Then use permission sets to grant more permissions as needed.

For more information about Profiles and Permission Sets, refer to the following Salesforce Documentation: