Not like oracle SOA Suite 10g, Oracle SOA 11g is having different roles to restrict the access of the EM console.
Refer the below URL for the details about user roles for EM console.
Access to the Enterprise Manager console is determined by the role assigned to the user.
The steps to configure the different EM console roles to the user.
Through EM console
1. Create the corresponding users through weblogic console
2. Now log in to the Enterprise Manager console with admin privileges. Under SOA folder right-click on soa-infra and select Security -> Application Roles.
3. Click on the search button without entering the role name. This will list of all Application Roles.
4. Click on the corresponding role.
5. Scroll down and click on add user. Click on the search button, this will list all the available users. Select the user from left side (Selected Users) and move to Right(Available Users) and click OK.
The below WLST script can be used to assign the different EM console roles to the user.
grantAppRole(appStripe="soa-infra", appRoleName=roleName,principalClass="weblogic.security.principal.WLSUserImpl", principalName=userName)
This will assign the specified roles to the specified uses.