Account owners may assign users permission groups according to their roles. For example, you may not want certain users to have access to invoices.