How do permissions work?

Go to Staff, then Roles & permissions. That page has two tabs: Roles, for creating a role and setting what it can do — the mechanics of that are covered under Roles and permissions management — and Permissions, where you pick one employee and assign or remove direct permissions for their account, on top of whatever role they're already assigned.

That per-employee override is what this page adds beyond roles alone: someone can keep their assigned role and still get one extra permission, or lose one, without you creating a whole new role just for them. Which permissions a role — or an individual override — can actually control varies by feature, not a fixed set. Some features are a single view-or-manage toggle; invoices break that out into many more individually assignable actions — issuing, cancelling, recording a payment, refunding, and more — covered under Invoice permissions.

Between the Roles tab and the Permissions tab, that covers every way access gets decided for your team.