If a user connects to the Switch Server through the Switch Web Portal, through the legacy SwitchClient, or through Remote Designer, he must enter a user name and a password. The user name identifies the user to the server and grants him access based on his permissions. For example, if a Remote Designer user has read-only access, he will be able to view all flows and settings, but he will not be able to change anything.
If several users should have the same permissions (for example because they have the same role), you may consider to group them and define their (access) rights at group (or "role") level. This will save you time if something changes. For example, if a new employee with a particular role enters the company, you can simply add the new user to the appropriate group.
With this setup, you have to configure the permissions and access rights only three times, instead of e.g. x times (with x being the number of users).
If you have configured a group, you can define a group manager for that group. Group managers can view jobs of their group members, whereas regular group members can only see their own jobs (unless otherwise configured).