How do permissions and roles work?

Access is governed by IAM: you grant permissions through policies and assign those policies to users (often grouped into teams). This lets you give each person exactly the access they need.