Every person your business knows about, the accounts that sign in, and the roles that decide what each one may see and do.
A person is a record; an account is how a person signs in; a role is what that account may do. Keeping the three apart means a customer, an employee and an admin are all people, and only some of them ever get an account.
Permissions are grouped by domain and enforced in the database, so a role's reach is the same in the web admin, the mobile app and the assistant.
In the admin
Generate your starting point in the console, or have us build it for you; the module is already there.