User Management, Roles, and Access Control Across Sites
Two user layers
Site Factory has factory users (people who log in to the management console) and site users (accounts in each site's own database). They are separate. A factory user's role controls platform actions: create sites, clone, delete, manage site groups, manage users, view reports. A site user's Drupal roles control content and configuration inside one site. Do not assume a Drupal role grants factory access, or that a factory administrator is automatically a content editor on every site.
Roles and scoping
Typical factory roles include Site Factory Administrator (full platform control), Site Builder (create and manage sites within assigned site groups), and Site Owner (manage a specific site or group). Site groups are the scoping mechanism: assigning a role within a group limits that user's visibility and actions to that group. Automation uses API keys or Drush credentials that inherit the permissions of the associated user, so key management is access control.
Traps
Assuming users are shared across sites (they are not, unless you implement SSO or a shared user strategy). Assuming a user who can create a site can also administer every site. Forgetting that removing a user from a site group does not delete their site-level Drupal account.
Rule of thumb
Model access in two passes: first the factory role and site group (platform scope), then the per-site Drupal roles (content scope). Audit both layers separately.