Administrator accounts. Access is enforced by the API, not by this screen.
Users receive roles. Roles grant permission codes. The API checks those codes on every request.