What roles are available and what can each role do?

ComplyBar has five roles, each with a distinct set of permissions:

• Account Owner — Full control, including billing, subscription management, and seat changes. Can invite/remove members, assign roles, create/edit/delete tasks, lock and reopen periods, export evidence, and configure every organization setting. Each organization has exactly one Account Owner.
• Admin — Everything the Account Owner can do except manage billing or transfer ownership. Can invite/remove members, manage tasks, periods, templates, and org settings.
• Manager — Can create and manage close periods, tasks, and templates, and can review or approve any task. Cannot invite users or change org settings by default (an Admin Settings toggle can extend invite rights to Managers).
• Member — Completes their own assigned tasks, attaches documents, and comments on any task. A Member can also review or approve tasks, but only on the specific tasks where they've been explicitly designated as the reviewer or approver — it's not a blanket permission.
• Viewer — Read-only access to tasks and dashboards. Cannot create, edit, comment on, or sign off any task. Viewers never consume a billable named-user seat — they're billed at the separate $1/month viewer rate.

The permissions matrix is enforced at the database level through row-level security, so role boundaries are load-bearing — not just UI guards.