It appears the answer (if you want differentiated permissions, e.g. user vs admin, or role based access control) is "purchase the enterprise edition" - https://docs.onyx.app/enterprise_edition/overview

edit: added clarification