Choose the smallest useful role
Admins manage membership, subscription changes and destructive actions. Members manage operational work and integration retries. Viewers read the information available to them. A viewer cannot gain write access by asking the guide to act.
Access is checked for each action
A visible button is not a permission grant. The server checks the current membership and workspace when it receives a change. If a role changes while a dialog is open, the change can be rejected even if the dialog opened successfully.
Review sensitive changes
Invitations and assignments should name the recipient and object before confirmation. Financial or irreversible changes need an explicit review of consequences. Never give someone an admin role just to work around an error; investigate the missing capability first.