Aside from the platform allowing control on who has access to certain pages and fields throughout the app, it also has the ability to create and maintain Sharing Groups. This allows for record-level control so that users/roles will only have access to certain records in various entities in the app. For example, you need to limit access to Account records depending on the country configuration of the user. This is where Sharing Groups can come into play.
Roles - Allows the control of what areas (e.g. pages, fields, etc.,) that users will have access to in the app.
Users - Users are assigned a roll upon provisioning. This allows you to control what the application user is allowed or not allowed to do once signed it. Roles can be changed to instantly raise or lower the level of access they have within BillingPlatform