A role is a grid, not a job title
For every area of the app, one answer: how much, over whose records.
Four levels, described the way people talk
No Access is "hidden entirely — not in the menu, and the page cannot be opened by typing its address". View Only is "can open and read everything here. No buttons to add, edit or delete". Standard is "everyday work: add and edit records. Cannot delete, approve, or change settings". Manage is everything, including deleting, approving and changing that area's settings.
Whose records, as a separate question
Level and reach are independent. Someone can hold Manage on expenses and still see only their own — Own Data means "only rows this user created or is assigned to", All Data means "every row in the company". A field worker gets Standard on their own time; a controller gets the same level across everybody's.
Which jobs, decided once for the whole role
A role reaches either every job in the company or only the jobs its holders are on the team for. It narrows and never grants: the levels still decide what can be done on the jobs it reaches, and a job outside that set reads as not found rather than forbidden.
The consequential actions come out separately
Approving expenses, deleting a closed job, emptying the trash permanently, signing proposals, and seeing job cost are each their own switch — "actions that move money, destroy records, or expose what a job is making". None of them ride along with a level.
Nobody can build a role above themselves
Any option beyond your own access is greyed out in the editor, so a role cannot be used to grant more than the person creating it holds.
