Four built-in roles (Administrator, HR Manager, Accountant, Employee) and custom roles built from permissions in the resource:action format.
The built-in roles
Every company starts with four roles: Administrator (full access to the company, including billing and API keys), HR Manager (employees, departments, positions, benefits and time clock), Accountant (processes and approves payroll, reads reports) and Employee (their own data only, through the portal). Whoever created the company is the owner and cannot be demoted by another user.
Custom roles
Under Team > Roles, create a role and tick the permissions. They follow the resource:action format and cover payroll, employees, users, time clock, surveys, settings, reports, performance, onboarding, expenses, documents, departments, billing and API. A common example is a "Finance" role with billing:read and reports:read and nothing from payroll.
Least privilege
Give each person only what they use, and review roles when someone changes function. Every action that changes data is in the audit trail with the user who performed it, so an extra permission is never invisible: it shows up in the log when used.