The interface is the tour: users, sessions, the audit trail and the settings that shape the server.
Authorization explains the two separate permission systems, and how to hand one application to somebody without handing them the server.
Security states the guarantees, the parts that are yours to get right, and the known limits.