The Integration involves only a few Roles in a project. Generally, aside from Administrators, there are ALM users that can create and run Tests or Test Set, ALM Approvers, and Tosca users that author Test Cases and Execution Lists.
For further details on VERA specific roles, refer to the VERA documentation.
The following categories exist:

• Authors: In VERA, general users who are responsible for creating or updating Tests or Test Sets and submitting them for approval. In Tosca, authors develop Test Cases and Execution Lists to achieve specific test objectives.
• Approvers: Users with the authority to review records and approve them with an electronic signature.
• Administrators: Users with elevated permissions for configuring a VERA project in QC/ALM or in Tosca.

Tosca Author Roles

Define groups/roles in Tosca for the typical Tosca engineer to be able to create Test Cases and Execution Lists.
If desired, use Tosca groups to restrict which users can see which folders in Tosca. When a VERA user creates a Test or Test Set in VERA and selects an item from Tosca to associate, VERA asks for Tosca credentials. Each Tosca user's group membership restricts what items are available for association/linking, in the same manner as Tosca Commander, depending on how Tosca group ownership is defined.
For example, in the Tosca Test Cases module, 3 folders can be setup, with each folder's group ownership assigned to a different group that represents 3 different projects. When a VERA users creates a new Test to link to a Tosca Test Case and provides credentials that belong to "Project 1", they can only see the folder that has its Group Ownership attribute set to "Project 1".

Tosca Admin Roles

Carefully restrict those users assigned to Tosca Admin groups. As with any software system, any user that has an Admin role, as has the ability to disrupt normal operation. Administrative procedural controls must be in place to restrict those users that have this role. The typical user should not have this role.
Admins may be called upon in support scenarios.

VERA Author Roles

These default VERA roles allow a user to create a VERA Test or Test Set, associate it with a TOSCA item, Route for approval, etc.

VERA Approver Roles

Other roles enable approving items in VERA. These are typical default VERA roles.

Tosca groups are organized as needed. However, the normal automation engineer that authors Test Cases and Execution Lists are not part of an Admin group. Tosca Administrator privileges must be restricted to only those authorized to perform system administration tasks.