The four roles

Four roles cover almost every situation, and picking correctly the first time avoids most later access work.

What each is for

Owner controls the organisation itself, including billing and its existence. Keep this small.

Admin manages people and settings but is not the last word on the organisation. This is the right role for whoever runs the team day to day.

Editor makes things. This is most people.

Viewer sees work without changing it. Right for stakeholders and clients who need visibility and should not be able to edit.

Steps

1. Start everyone at the lowest role that lets them do their job.
2. Promote on request rather than in advance.
3. Review roles when someone changes job.
4. Keep more than one owner, so nobody is a single point of failure.

What to watch for

Making everyone an admin because a permission got in the way once is how organisations end up with no meaningful access control at all.