Everything someone can see or do in a workspace is decided by their role(s).
The key ideas
A permission is one specific thing someone may do, such as "Post on wall" or "Approve notices".
A role is a named bundle of permissions, such as "Trainer" or "HR".
A person has one or more roles. They get the permissions of all their roles added together.
Admin is a special permission ("manage workspace"): it grants everything, including every permission in the list. Give it only to people you trust fully. Workspace owners and anyone marked admin always have it.
A person with no role in a workspace does not see it.
How a request is checked
When someone does something, Rosterr asks one question: "is this person an admin, or does one of their roles include the permission this needs?" If not, it is refused. When a route needs one of several permissions, any one is enough. When it asks for no permission at all, any member may do it.
Roles come from your Roblox ranks (usually)
You connect Roblox group ranks to roles, and Rosterr keeps people on the right role as their rank changes. You can also give someone a role manually (they are then left alone by the automatic sync). See "How do people join my workspace and get their roles?".
Where to manage roles
Settings > Permissions. It has:
Roles: create, edit and delete roles, set permissions and connect ranks.
Users: add people, give roles, remove people, resync.
Departments: organise people (these are not permissions).
Things to know
The Owner role is protected. Its name, permissions and rank connections are managed automatically.
Each Roblox rank can belong to only one role.
Features switched off (Settings > Features) hide their pages even from people whose roles include the permission.
Changes take effect within about half a minute. Rosterr remembers a person's permissions briefly for speed. If you have just changed a role, wait a moment or ask the person to refresh.
The audit log records role changes, naming each permission that was added or removed.
Least privilege: a good habit
Give each role only what the job needs. Keep Admin for owners and a few trusted people. For example:
A trainee needs to see sessions and claim a place, nothing more.
A moderator needs moderation permissions, not settings.
An HR role needs the logbook and notices, not mail management.
Related articles
Create and edit a role (and choose its permissions)
Permission reference (1 of 4): wall, staff, members and logbook