Objects explained

An object in vSphere can be described as the target of the action. Objects include datacenters, clusters, ESX/ESXi hosts, vApps, resource pools, virtual machines, clusters, datastores, networks, and folders.

A permission grants the user or group the rights to perform the actions specified in the role for the inventory object to which the role is assigned. A permission can be assigned to any object in the vCenter Server inventory. Each object has a Permission tab that shows which users or groups and roles are associated with it. To access the Permission tab of an object, select the object from the inventory and go to Manage > Permissions:

In the picture above you can see that the Administrator role for this object has been granted to the root and Administrator users and the domain group ESXi Administrators.