Setting up permissions is described in detail here: Permissions

Permissions are set up globally in the "Administrator" window in the "Universe" tab, in the "Global access rights" tab on the right.

In this tab, you can add user groups and assign them the necessary permissions, determining the group role.

You can use a preset role, or create your own. To create a new role, use the "Roles" button.

The "Conditional" column means that this permission clause would only be active if the user is "Assigned" to a task.

"Global permissions" would be inherited by all created projects. When creating a new project, you will be able to customize "Global permissions" by adding or deleting groups or users with certain roles.

"Project permissions" would be inherited by all project tasks. If necessary, you can customize permissions of a separate project task or task branch. To do so, go to the task's "Properties" (you can open "Properties" by clicking the "Properties" button in the right part of the Cerebro window, or via the task's context menu), click the "Permissions" button (the "key" icon), uncheck "Include inheritable access rights" and set up task permissions to suit your needs.