Two separate sets of roles, who can manage them and which are protected.

Create a role, tick its permissions, save, and delete it when nobody uses it.

What each preset ticks, and Apply recommended on the built-in remote roles.

Every permission group a role can have, with how many boxes each holds.

The six department boxes, how a department is matched, and what members still see.

The permissions that manage roles, and why you can only give what you have.