Answers
Your team: who sees what
Everyone on your account gets their own sign in, their own dashboard layout and their own saved views. What differs is what they can CHANGE and what they can SEE, and those are two separate questions.
Two roles, on purpose
An admin manages connections, modules and people. A member reads the dashboards and asks questions, and changes nothing. There is one owner, set when the account was created, and that cannot be handed over from here. Two roles rather than ten because every extra role is a question somebody has to answer at three in the afternoon about a person they are trying to help.
Deciding what somebody sees
When you invite a member, you tick the areas they get: revenue, ad spend, leads and customers, calls, pipelines, affiliate commissions, site traffic, competitors. A bookkeeper probably needs the money and not the competitor rankings. Somebody running your ads probably needs spend and not the affiliate commissions.
This is a real permission, not a hidden menu. Anything unticked never reaches their browser at all, and Ask AI will not answer from it either, so there is no clever question that gets around it.
Admins see everything by role, so they get no ticks. Areas belonging to a module you have turned off are not offered, because a module that is off is off for everybody.
Changing somebody later
Select anyone in the user list and their details open underneath: photo, name, role, sign in email, and what they can see. Changing their email moves everything with them, their permissions, their dashboards, their photo, and their existing session keeps working through it.
When somebody leaves
Archive them rather than deleting them. Their sign in stops working that second, and every link they hold is dead from that moment. But their name, their permissions and their saved dashboards are kept, because people come back: the bookkeeper for next season, the contractor for the next project.
Bringing one back shows you exactly what they could see before, so you can trim it before you confirm rather than discovering it later. They get a new sign in link, and the old one stays dead.