When having big application with different not exactly specified roles usualy the pages (their url), buttons and links are marked like resources. When creating a new user group the administrator can specify the resources that the users of this group can access.
-- Seeing is believing
