Every ENSv2 name uses two kinds of contract. The registry says who controls the name. The resolver is a contract on the Ethereum network that answers questions about the name, such as which address it points to. Both are permissioned: a wallet can change something only if it holds the role for it.
The registry: who controls a name
A permissioned registry holds names and records which wallet holds each role on them. A role can sit on one name or on the whole registry; a role on the whole registry covers every name in it.
Registries nest: the .eth registry holds your name, and your name can have its own registry for subnames. It needs one only if you want subnames.
Let another wallet create subnames
Open your name's Roles tab. Under your name's own registry table, select View and manage, then Add user, and tick Registrar. No registry yet? Set one up first: Create a subname (ENS Explorer). Guide: Grant registry 'roles' to manage your name
The resolver: what a name points to
A permissioned resolver holds names' records, such as addresses and text records. One resolver can serve many names. A role on it can cover one kind of record, or one text key or coin type, but always on every name it serves.
When you register a name in the ENS App, your wallet and your smart account (HCA) both hold every role on its resolver. A later name from the same wallet reuses that resolver, with any roles you have added to it. More: What is a resolver?.
Let another wallet edit your records
Open your name's Roles tab. Under the resolver table, select View and manage, then Add user, and tick the records it can set, such as Set Text for avatar and links. This covers every name on the resolver. Guide: Grant resolver 'roles' to edit name records
What "permissioned" means
Each role has an Admin. A wallet with the Admin can give the role to another wallet or take it away. Once no one holds a role or its Admin, it is locked for good.
Where to see them
Open a name in ENS Explorer and select Registry to see its registries as a tree.
For subnames: What can the parent of a subname still do?. Had a Manager on ENSv1? See What happened to the Manager role?