The four roles and what they control

The four roles

Every member holds exactly one role: owner, admin, editor, or viewer. They run from most access to least in that order, and a person's role decides everything they can and cannot touch.

What each one can do

• Owner: full control. The owner is the only role that can act on billing, which means topping up credits, changing plans, or opening the billing portal, and the only role that can transfer or delete the organisation.
• Admin: runs the team and the organisation settings, and can connect ad accounts. An admin can look at billing and usage but cannot change a plan or pay for anything.
• Editor: makes and edits the work itself, projects and generations, with no control over the team or billing.
• Viewer: read-only. They can see the organisation's work but not change it.

Changing someone's role

Change a member's role from the Team tab. A clean, common setup looks like a small company: the founder is the owner and holds the card, an operations person is the admin who watches spend and runs the team, and the people making creatives are editors. Match the role to the job and most access questions answer themselves.

One honest note

A few of the organisation security-policy toggles are stored as your stated intent rather than enforced the instant you flip them; they take effect in later platform phases. Treat those as policy you are putting on record, not a switch that changes behaviour right now. The security help spells out what is actually enforced today versus what is captured for later.