The role sets the basic scope; individual switches grant specific capabilities. A small company will usually use Owner – Team Lead – Worker. Owner is the protected primary administrator role, so it is not offered as an ordinary choice while editing a member.
In Member management, use the gear to open Edit member. A Worker works on assigned projects and personal records. A Team Lead is a Worker with responsibility for an assigned team. An Admin has a company-wide overview and manages members and their permissions.
Use Assigned projects to define where the member can work. Then enable only the standard capabilities they need: creating receipts, bypassing required photo attendance, reporting quality issues, and working with their own project photos.
Configure team membership, leads, and projects in Team management. In Edit member, enable the required extended capabilities: team attendance, copying personal attendance, checking members in or out, statistics, quality issues, or photos. These permissions apply only to assigned projects and the permitted team scope.
Extended administrator permissions have company-wide scope, such as receipt approval, attendance overview, statistics, or quality issues. An Admin may adjust their own optional permissions; a Team Lead cannot change their own extended permissions.
Save the member and check their dashboard. A hidden or visible button is not the only protection: access is also limited by role, project assignment, team scope, and server security rules.