Six fixed roles control what each user can do. Permissions are enforced by the server on every request; you can rename a role or change its description.