Role

A role defines an access-control profile. It has a series of grants (or denials) for schema elements.