Base (0): Can be authenticated but does not have any authority to create or update content. Base level Users can be used to allow access to specific content or functionality only after being logged in, but should not be granted authority to create content.
For example, a User could be required to have an account and be signed-in prior to submitting a comment or rating on content, or prior to accessing all content (aka subscription).
Contributor (1): Can create and update an Entry they have created or are assigned to but cannot update Entries they did not create or are not assigned to. Contributors may not select to make an Entry "Published" unless they have been expressly granted editorial bypass privileges by a Manager.
Editor (2): Can create Entries, and can update both their own Entries and those created by other Users. Editors can change the status of Entries to "Published."
Manager (3): All the privileges of an Editor, but also the ability to create and edit Project settings such as the Content Model.
Users can be put into Groups. Groups are used to organize Users, and can also be used to limit the types of Entries that any User can access.
For example, access to create a specific Content Type can be limited to certain User Groups.
It is also possible to limit the ability to edit or access a specific Elements by User Group.
For example, you could have some Elements that only Users in specific Groups can access.