Para defines three security groups and roles:
users
user
mods
mod
admins
admin
There is also a special role app for applications.
app