It should be all explained in
https://openacs.org/doc/openacs-4/permissions.html and the neighbouring pages.
Well, maybe not all of it, but it's a start. To explicitely restrict access to a page use permission::require_permission. Note that some procs mentioned in the docs have been superseded by newer ones - they will be marked as deprecated in the api browser with a reference to the new one, so make sure to check /api-doc/ before using them.
