Here is how the security date is organized:
A role contains one permission set. It can be granted to N users or N user groups. If it is a shared role, it will contain one permission set for each application.