When you create a new CollectionSpace tenant for your museum, you will start out with two users:

An Administrator user, assigned to the TENANT_ADMINISTRATOR role. (This user is granted all permissions, including the rights to create and configure the permissions for additional users.)
A Reader user, assigned to the TENANT_READER role. (This user can read all data, but can't make any changes.)

You will likely want to create additional users. Via the pages under CollectionSpace's Administration tab, you can:

Create new roles as needed, defining custom combinations of access permissions for each role.
Create new users.
Assign one or more roles to those users. (If a user has multiple roles assigned, they will be granted the most permissive set of permissions allowed by the union of those roles.)

For details on how to make very specific configuration changes, see the relevant individual documents linked under Configuring CollectionSpace -> How to create and manage users, in the sidebar at left, or as Child Pages below.

Browser not supported