Kibana usage on user and roles

without any code changes, with some configuration changes, can I do the following

can I define a role, where users can only be able to see discover, dashboard, visualization, they should not be able to see plugins, security, and all ??

Do we have an architecture document for user management in kibana, what index user data is stored, what format?