(i) The text below is only about user permissions, but it also applies to application permissions (only for Building Automation).
You can grant permissions to a user in two ways: via roles and via the user-specific permissions. A combination is also possible: the user then gets the permissions defined in the role(s) plus the user-specific permissions. The user-specific permissions tile does not show the permissions the user has because of being assigned a role.
The user-specific permissions tile lists all permissions per service that can be given to a user within that organization (depends on the subscription type).
For an explanation of all permissions (for Building Automation only), see Explanation of user permissions in Priva Access Control (Building Automation).