I usually have classes representing users, roles, and permissions. Users belong to Roles and Roles, which are allowed permissions. Permissions are required to access other objects. In UML, I assume that you will model the role as an abstract base class and have several different implementations, one for each role.
, , , , - (, ). . . , , .