Users access is set up through roles. These roles define what permissions a user has on what zone. A user might have administrator access on one zone and only content creation access on another. Users can have as many roles as needed.