diff --git a/User-documentation.md b/User-documentation.md
index ef6174e..cabb843 100644
--- a/User-documentation.md
+++ b/User-documentation.md
@@ -64,10 +64,18 @@ If everything goes well then after submitting of files progress bar of evaluatio
 
 // TODO: create, delete, update, manage licenses
 
-### Groups
+### Users management
 
-// TODO: management, higher privileges than supervisor
+There are only few roles to which users can belong in ReCodEx. Basically there are only three: student, supervisor, and superadmin. Base role is student which is assigned to every registered user. Roles are stored in database alongside other information about user. One user always has only one role at the time. At first startup of ReCodEx administrator should create his/hers account and them change role in database by hand. After that manual intervention into database should never be needed.
 
-### Users management
+- Student -- 
+- Supervisor -- Inherits all permissions from student role.
+- Superadmin -- Inherits all permissions from supervisor role.
+
+There is a little catch in groups management. Groups can have admins and supervisors. This setting is valid only per one particular group and has to be separated from basic role system. This implies that supervisor in one group can be student in another and simultaneously have global supervisor role. Changing role from student to supervisor is done automatically by application and should not be managed by hand in database!
 
-// TODO: list of recodex roles, user actions (delete, create, update or whatever)
+// TODO: user actions (delete, create, update or whatever)
+
+### Groups
+
+// TODO: management, higher privileges than supervisor