User permissions apply to an entire Web, not to documents themselves. However, you can have additional sub webs that can optionally have their own permissions. Each user can be given any of four default roles. The administrator can define additional roles.