How do user roles and permissions work?

Granular, module-level access control. A project manager can view CRM but not edit it, or see only the projects they personally created. Vendor access is equally controlled — you decide what they can and can't edit. Settings change instantly, any time, with full logs of who changed what.