If access is decided person by person, nobody can say what a job is allowed to do. A role is that statement. Assign the role, and the permissions travel with it.
What a role decides
Which modules the person can open, and which actions they can take inside them: view, create, edit, delete, and the more specific actions each module offers. How roles and permissions work describes the product.