The users can be grouped and can inherit rights in this way. Thereby you can integrate a highly sophisticated and close grained user management that closes all potential loopholes via shortcuts with minimal effort. Only if the user has been granted the specific right by the administrator he can see or use the specific function assigned by the administrator.
The administrator can configure the rights at run-time thereby preventing a restart of the program when changing assignments. For doing so he can use an easy to handle, intuitive GUI that enables the administrator to create new users or to group or delete them directly from the application.