What determines what I can see and do?
Two things working together: role-based access decides what actions you can take, and entitlements/plan scope decide which modules your company has turned on. That's why two people at the same company can see different menus.