Permissions are tied to user roles. When adding users and groups to an extranet space, a role needs to be selected.
When you assign a user or group to an extranet space, you must specify user roles. The permissions set by the administrator are linked to this role. You can create up to five user roles with different sets of permissions. The boxes/checks represent the permissions. If boxes are checked, the user receives those permissions (as long as they received the role).What are user roles?
Navigate to Confluence administration → Space Privacy → Roles & Permissions → User Roles. Click on the Edit button at the bottom of the page. Enter the name of a role and activate the Enabled checkbox if you wish to activate the role. Activate the checkboxes according to the permissions you want to give said user role. Finally, click on the Save button.Define user roles
New in 3.5: Handle assignments of deactivated roles
When you want to deactivate a user role and already have assignments for it, a small 
icon appears next to the checkbox. Clicking the icon opens an option dialog offering two options:
- Keep existing assignments
Existing assignments will be kept and only new Extranets won't create the roles (default prior to version 3.4) - Migrate existing assignments
Existing assignments will be migrated to another role. So the role can be disabled safely.
The icon will only appear if a role is or will be deactivated and assignments for this role exist.
Please note that this procedure might take some time and should be done outside the office hours.
Migrating a role will not deactivate the role, this happens by clicking the Save button. A deactivated role will not be available for future Extranets.
Link to this page: https://seibert.biz/extranetuserroles