Create the role under the user-role configuration, defining the module and data-group permissions it should carry. Then open the employee's user account and set this role as their user role. The employee gains exactly the access defined by that role on next login.
How do I create a user role and assign it to an employee?
