Who can do what

A role belongs to a person in one company, not to the person. The same human can be an admin in one company and an ordinary user in another, and signing in to each one gives them that company's role. So the answer to what somebody can do is always about the company they are in at the time.

An admin runs the company: settings, invoicing, who is invited, and the money screens.

An ordinary user does their own work. They see the projects they are on, track time and talk to the team, and cannot reach company settings or invoicing.

A guest is somebody from outside who has been invited to particular projects. They see those projects and nothing else, and no money anywhere.

A client contact sees their own projects and what has been sent to them.

Two things sit beside the role rather than inside it.

Access to the finance screens is a switch on the person, not a consequence of being an admin. Every admin had it switched on when the switch was introduced, so the two usually agree, but an ordinary user can be given it and an admin can have it taken away. Nobody should infer one from the other.

Being counted as an owner is a separate flag again, and it is about arithmetic rather than authority. It decides whose hours count as owner hours in the profit per owner hour figure. A company has one legal owner for billing and that is a different thing.

Each person also carries their own money settings, set by an admin when editing them under Users: a Default User Rate, which is their pay rate, and a Billing Multiplier, which turns their worked hours into billed hours. Both are explained in Rates.