User can be assigned a "role" in any TeamCity project, or a global role (a role not specific to any particular project). Currently, user roles can be edited only in user's profile, see "Roles and Permissions" tab.
The set of available roles is fixed. Here is the list with a brief description:
Can view the builds of a project, browse build results including artifacts and list of changes (but not file content), set notifications for the project, view queued builds of the project, etc.
Includes all actions available to "Project viewer" and additionally, can run/stop builds, run personal builds, browse file contents (via web diff view), reorder the build of the project in the queue, browse build configuration settings.
Includes all actions available to "Project developer" and additionally has access to administration area where can change settings of the project, create/delete and change settings of project's build configurations, set-up clean-up rule for the project's build configurations.
All projects viewer
Global role. Analogous to "Guest" access in older versions. The same as "Project viewer", but can view all the projects in the system.
All projects developer
Global role. Has "Project developer" access to all of the projects in the system.
Global role. Allows to enable/disable agents.
All projects administrator
Global role. Has "Project administrator" access to all of the projects in the system, can create and delete projects, manage VCS roots shared between projects. Includes "Agent manager" role.
Global role. Includes "All projects administrator" role. All administration tasks (including editing of user profile and roles) are available for this role.