The Security section of the Devolutions Password Server Console allows you to manage your instance. These management features are exactly the same as the one offered under the Administration tab of the various Desktop Clients, when they are connected to that instance through a Data source.
Since the latter is the one you will spend most of your time using, whenever a new instance is created, we recommend creating an administrative user, then register the instance as a data source in your Desktop Client of choice. This will bring you in a more familiar territory and will help you get around more quickly.
If you are indeed using full AD integration, whereas the assignment of permissions comes mostly from AD Group membership, then the roles are the mechanism that make this work.
The sections below are to cover the basic management features if you cannot use a desktop client.