Open Distro Security Roles are the core way of controlling access to your Elasticsearch cluster. Roles contain any combination of  permissions; cluster-wide permissions, index-specific permissions, document- and field-level security, and tenants. Then you map users to these roles so that users gain those permissions.