Zephyr comes with 4 default roles (Test Manager, Test Lead, Tester, Defect User) but then allows you to create (or modify or delete) additional roles and decide which Department-level of Project-level applications those roles can have access to in their Desktops. The default roles cannot be modified or deleted.
In the example here, a new role "admin" has been created and 2 Department-level apps - Administration and Resource Management - have been turned on for that role.
Once a role has been created, then users can be assigned those roles in the Resource Management application. Those users will also have to be allocated to a project in order to log into Zephyr and use Project-level applications.