Every user has a role. And a role can have a profile assigned to it. If a profile has a specific permission, then users who belong to the profile will also have that permission. For example, if a profile is given permission to edit or delete records, then the users of the profile can edit or delete records. On the other hand, you can also assign privileges directly to a role.