Major Description
We can implement common approach:
Declare groups.
For each group assign available screens.
For each screen assign available actions.
Implement adding users to groups.
If admin added/removed EXISTING user to some group, that user should receive notification.
If admin added NOT EXISTING user to group, that user will receive invite.
User should be able to see own permissions, for example on profile page.