It's very simple :)
configuration>Access Roles>choose the role that u would like to assign for it bw contact - and u done!
*dont forget to apply and save in the end*
- PER AP-GROUP - for all the AP-GROUP (group)
- PER USER - per user :) (single)
- PER ROLE = for all the users using this ROLE (group)