User permissions apply to an entire Web, not to documents themselves. However, you can have additional sub webs that can optionally have their own permissions. Each user can be given any of four default roles. Additional roles can be defined by the administrator.