Roles drive access. Hierarchy: owner > admin > estimator > crew lead > crew member. Only owner/admin can change roles (enforced at the database). Use Invite member to send a magic-link with a pre-set role. People who sign in on their own without an invite default tocrew_memberand can be promoted here.