Java Authorization Concept

In the UME authorization concept, why can an administrator never assign a permission directly to a user?

How does the authorization check for a JEE security role differ from one for a UME permission at runtime?

An application must protect three things: whether a user may open it at all, a specific Delete activity inside it, and an individual document. Which authorization mechanism guards each?

What information does a JEE security role actually contain, and why is calling it just SAP's name for a UME role wrong?

An administrator holds the action that lets them create and maintain roles. Can they use it to grant themselves a powerful role?

Why does ACL maintenance look and behave differently from one AS Java application to the next?

Can an administrator create a new UME action to fine-tune what a role grants?

A user is assigned a security role named Approver in one module of a JEE application, then accesses another module protected by a same-named role. What happens, and how does the UME make this manageable?