There are multiple types of Users, from a System User – who would have access to all the data and permissions to do actions such as refunds, troubleshooting, research and more, to an External Agent user, who might have ‘read only’ access or wish to reconcile their payouts.
The Service Provider Admin creates Users for Platform Accounts/Sub-Accounts/Agents (Sellers/Merchants/Sub-Merchants/Agents). It grants users roles or permissions based on the categories created.
There are two main User Roles categories: Base User Roles and Custom User Roles.
Base User Roles are general user roles:
There is a set of default configuration options for Back-Office Users such as:

Users access the System functionality based on the permissions level assigned by the superior Entity Users. Users’ hierarchy follows the System Entities hierarchy, where permissions descend from top to bottom.
Custom User Roles may be created based on any Base User Role with a unique name and Id. Custom User Roles may have different permission requirements than your standard users. This functionality is used to apply specific criteria for unique situations. They can be configured to have an individual set of permissions, different from the standard ones.
Custom User Roles are created and configured by the system administrator. While creating a new system user (Back-Office User or API User), you have an option to assign a new user one of the Base User Roles or a Custom User Role, based on your Service Provider settings.

Please note that a Service Provider Admin can only Edit relevant Service Providers Entities. Service Provider Admin is not authorized to add/remove Service Providers Entities. Same logic applies to Platform Admins — can only edit relevant Platform Accounts Entities.