Official Acumatica Documentation, permission topic

Hi Ivan,

I think I know the answer. It may not be complete but it is a start point.

API in Acumatica features 2 different solutions:

• Screen-Based Web Services (SOAP)
• Contract-Based Web Services (REST)

The little I know is about the REST API that is based on endpoints and contracts which define the Acumatica objects (entities, fields, actions on entities) that are exposed through the API. You can see this as a first layer of access rights as you can only access what is exposed by a contract. 
A good start point for reading about Contract-Based Web Services is here: https://help.acumatica.com/(W(3))/Help?ScreenId=ShowWiki&pageid=91dda8ed-5e92-48a5-a176-9a255506d0d6 
Also, during the connection, you must supply an Acumatica user/password . Any user in Acumatica is associated to one or more user roles which define, in deep granularity , what a user can access and what  a user can do with the accessed data. 
If you need to understand User Roles in more details, check this link:https://help.acumatica.com/(W(4))/Help?ScreenId=ShowWiki&pageid=87725d67-0299-44c6-9dff-0302579217b0

I am not sure yet  how the combination of contract and user roles work together. I am still learning about it.

With our VAR they spent some time on Admin training and this was very helpful. They went over the basic permissions for different employees at the company. The roles and permissions are quite complex in ACU this training was helpful.

I would send the client the guides and then schedule meetings with the different department heads to go over their employees daily tasks and determine what permissions are needed and what overlapping roles there are. 

Then find who would be the best fit as a Admin to manage their permissions going forward.