One of the products of my company is a web application meant to handle communication between agents and their clients for a company which doesn't sell directly to the end buyer but rather sells to agents.
Both the agents as well as the clients must be associated with a user account in this system, but the agents have the power to manage its clients any way he or she pleases, since they belong to that particular agent. The way we handle authorization is not by establishing what agents and clients can do but rather assigning roles to the users. The role of a user is its authorization essence without necessarily being associated to a particular user. When the agent adds a new user, that user automatically has client role, since the way it is setup, the user of a particular role can create new users of an inferior role and client roles, not having any role inferior to it, cannot create new users. Similarly, we have administrative roles which are superior to agents which can create and manage any agent or client role, but cannot create other administrative roles.
There exists one super-user account which can create and manage users with administrative roles, and of course, everything else. (How does a super-user get created? It doesn't. The username and password are established upon installation, and that username and password overrides any role or authorization.)
We call the section where users are created and managed and, in general, configuration of the behavior of the web application for said user since this is separate from the normal functioning of the web application, the backend. The front-end, on the other hand, represents the part concerning the buying and selling of products (anything which has nothing to do with the behavior of the program, in short). Granted, backend is traditionally used to mean the part of the web application that the users don't see, so perhaps it wasn't the best name. However, I thought I'd share this since it may be of use to the OP or anyone else reading.