Permission determines what users can do within an organization. Access determines other functions, such as access to Apex classes, app visibility, etc.