There are two key elements into play here:

1. Resources
2. Agents

Resources are objects. It can be anything that can be created. An image, a new user, or anything that you can think of.

Agents are the ones who take some action. Agents can manage resources (of course if they have the required privilege).

For example:

1. a user (agent) can add a new document
2. a user (agent) can add another user to group

We will talk about groups in detail later.