Roles and permissions
What each role is allowed to see and do across the workspace.
Administration → Roles
A role is just a name plus a set of permission checkboxes — assign it to members from the Members page, not here. This page only defines what each role can do.
System roles
Owner, Admin, Member, Approver, Auditor and Guest ship built in and can't be edited or deleted — create a new role instead if you need a variation on one of them.
Permissions
Grouped by resource (tickets, projects, SLA policies, etc.); clicking a group's heading toggles every permission in that group at once, and All / None set the whole list. Most resources split read from create/update/delete — a role can see something without being able to change it. A permission doesn't unlock a feature your workspace's plan doesn't include — the plan gates it too.