User roles vs. user permissions using apache shiro -

i trying model complex permission management system using apache shiro.

english not being native tongue afraid might missing of subtleties of terms such "roles", "permissions", "rights" & "privileges".

for example lets want create system manages resources such printers located inside buildings. db holds information of printer located in building. users of system should able reset printer or print it.

its clear me users "super admins" , able reset , print printer ('printer:*:*')- guess people have "super admin role".

but if should allowed reset printers in specific building ('building:a:*') ? "building admin" (prarametric) role? or permission on specific building? how model using apache shiro?

n.b.
when tagging q added user-roles tag , says:"a user role group of users share same privileges or permissions on system. use tag questions how user roles work in particular security framework, or questions implementation of user roles in program."

would correct assume based on definition there not such role "building admin" because being admin of building not give same permissions being admin of building b? , if so, correct terminology describe "building admin"?

have considered using more 3 tokens within wildcardpermission format?

there no limit number of tokens can used, imagination in terms of ways used in application.

— wildcardpermission javadoc

instead of domain:action:instance syntax commonly used in apache shiro examples , documentation, add token represent building, e.g. printer:print,reset:*:buildinga.

the downside of scheme whenever checking if action permitted on particular printer, you'd have specify location, though token representing printer instance might uniquely identify printer:

// let's role buildinga-admin has permission of "printer:*:*:buildinga"  subject.ispermitted("printer:print:epson123:buildinga"); // returns true subject.ispermitted("printer:print:epson123"); // returns false 

depending on application domain, maybe structure buildinga:printer:print,reset:epson123 might more appropriate or useful.

---

to answer other question regarding user roles, you'd correct assume if have both buildinga-admin , buildingb-admin roles, different user roles, if permissions assigned them not same.
might conceive general user role of building admin permissions admins different buildings might have in common, avoid duplicating permissions across different building-specific admin roles.