Category permissions can be inherited from the system host*, individual hosts, or permissioned individually. If you are hosting a single host that all have the same administrators, then category permissions might be more easily managed by editing the category and using the permissions tab to distribute category role/user access. However, a multiple-site implementation with various hosts that all need to be permissioned to differing roles/users will more easily be managed by setting up inheritance at the System Host/Host Level using Role Permissions.
To view the permissions set on a category, mouse over the Content Types Tab and click on > Categories. Then click on the correct category title or click the pencil icon to edit the category. Now click on the Permissions tab next to the category Properties tab.
Category Permission Inheritance from System Host
Below is an image of a category that is inheriting all its permissions from the "System Host". This means that permissions on this category is inheriting permissions directly from the Role permissons themselves set at the System Host or host* level.
Setting Individual Permissions
While editing a category, clicking on the Permissions tab and the "Permission Individually" button will stop any role inheritance coming from higher up the permission hierarchy and allows for permissions to be set on the category itself.
*For more information on setting permissions on dotCMS objects from the System Host, please see the documentation on Role Permissions.