After a user is authenticated, the framework handles access to pages and workflows. Within a workflow, permissions are assigned at the page level. Permissions are binary: access is either granted or denied. All standard BAM permissions still apply for any actions taken via the BAM REST API.
You can edit Permissions in the Permissions page in BlueCat Gateway UI. (Click 
Settings at the bottom of the navigator on the left,
then click Permissions.)