How is authorization in vCenter Server handled?

What will be an ideal response?

Authorization to perform tasks in vCenter Server is governed by an access control system that allows the vCenter Server administrator to specify in detail which users or groups can perform which tasks on which objects using the following terms and concepts:
Privilege--The ability to perform a specific action or read a specific property. Examples include powering on a virtual machine and creating an alarm.
Role--A collection of privileges. Roles provide a way to aggregate all the individual privileges that are required to perform a higher-level task, such as administering a virtual machine.
Object--An entity upon which actions are performed.
User or group--A user or group who can perform the action.
A permission is the combination of a role, a user or group, and an object. Roles are also configured on the ESXi host, similar to vCenter Server roles, which define things that the user is authorized to do on that host.