In Tacto, permissions are always tied to Groups – you cannot assign permissions to individual users.
Each Group is assigned a role: one of the three standard roles or a custom role.
A user can belong to several Groups and always receives all permissions from all of their Groups.
Without a Group that grants permissions, a user cannot make meaningful use of Tacto.
How Admins create users, Groups and custom roles is described in the articles "Invite & manage users", "Manage Groups" and "Create custom roles".