how do we define who can login to rational access manager

Hello, this is a really basic question but cant seem to find it in the documentation, I have installed RAM on websphere and connected it to an AD. Any user when they put in their  correct credentials can log in which shows authentication is working. How do I attach a group or role to these users in RAM/Webspere to restrict them logging  in (authorisation) as I don't want every user to have the ability to get past the login page.