A workspace has two roles, owner and member. Owners run the workspace; members see and decide what their work needs. The menu follows these rules, and every page checks them again on the server.
Owners invite and remove members, manage billing and the security settings, and make the decisions that can't be undone. Everyone shares the same AI team, runs and credits. Invite people and change roles in Settings → Company & team → Members; there is no separate admin role. Who may approve what is in My work and Needs you.
A row a member can't open is left out of their menu, and the page itself refuses too. An owner's Choose areas hides unused areas for everyone — see Getting started.
In Settings → Company & team → Members an owner can mark a member May approve bookings; it asks for the owner's password again. That member may then approve the bookings your employees prepare — create, attach, book, issue, rename — and can open Finance and Deadlines. Never payments, anything sent to customers, deletes or signatures.
On Integrations, each connected app has an access level: Read only (employees can look things up but change nothing), Read & write (deleting is refused) or Full (incl. deleting), where a delete still waits for your approval. An app with no level set is Full. Only an owner changes it, and raising it asks for the password again. A step the level blocks is refused and changes nothing, and the employee says why.