Assigning roles to users, departments, or groups — single-subject authorization, bulk authorization, viewing authorization relationships, and revoking authorizations.