User Role Editor (URE) is protected by key (main) user capability. What capability is used by URE as the key capability depends from these conditions:
1) If it’s not multisite WordPress environment, key capability is ure_manage_options.
2) If it’s WordPress multisite then:
2.1) If URE does not find PHP constant URE_ENABLE_SIMPLE_ADMIN_FOR_MULTISITE or it’s not equal 1, then key capability is manage_network_plugins. So by default URE is available just to a user with superadmin privileges.
2.2) If PHP constant URE_ENABLE_SIMPLE_ADMIN_FOR_MULTISITE is defined and equal to 1, or (Pro version only) checkbox “Allow single site administrator access to User Role Editor” at “Network Admin->Settings->User Role Editor->Multisite” tab is turned ON, then key capability gets the same value as for single WordPress: ure_manage_options.
