Typically members in an organization play different roles like system administrator, accountant, sales manager, project manager etc. and it is these roles that have privileges associated with them. Users who play a role automatically inherit the privileges granted to the role.

Like in the real world, in Celoxis you can define roles, assign privileges to roles and finally assign roles to the users. Privileges are never assigned to users directly but only through roles.