The role assignment is the relationship among the role definition, the users and groups, and the scope (for example, one user may be a reader on list one, while another user is a reader on list two).
The role assignment is what ties together the role definition (permission level) with the specific user or group, and the scope that that permission level will be applied to (i.e. site, list, folder, etc.). It gets a little complicated but it kind of works like this:
- The role assignment holds a role definition binding that links the permission level (role definition) to a user or group.
- The object the permissions are going to be applied to (web, list, etc.) holds the role assignment.
The relationship expressed through the role assignment is the key to making Windows SharePoint Services security management role-based. All permissions are managed through roles; you never assign rights directly to a user, but only meaningful collections of rights (role definitions) that are well defined and consistent. You manage unique permissions by adding or removing users and groups to or from role definitions through role assignments.