How to manage groups and users in Jenkins

I've recently upgraded the WIKI description:

Global Roles override anything you specify in the Project Roles. That is, when you give a role the right to Job-Read in the Global Roles, then this role is allowed to read all Jobs, no matter what you specify in the Project Roles.

It may therefore be advisable to leave most (all) options unchecked in Job, Run and SCM in the Global Roles section for normal users.

In a recent message on the jenkins-users list, user Romain writes:

We do the following:

• 3 main global roles, admin, job-creator, and anonymous.
• 1 project role per set of jobs to "segregate" from others.
• Users with job-creator role know the pattern of the name of the jobs they can create and are aware that, if they don't comply with it, they will need to ask the admin to rename the job or grant them new rights.