Individual user permissions can be specified by an account Owner or Admin user on an individual basis.  For example, you can permit one employee to only Read (and not Create / Edit) content.  The user-specific settings are defined and viewable on the Group tab.