Workspace Access sets what an Organization Member may do in the Organization. Each member has one of four levels. Each level includes everything the level before it allows.

Guest

Paid subscriptions only. May be the Assignee of an Assignment or Task, and may be given Guest Portfolio Access. A Guest cannot see the Organization's People, Positions, Catalog, or Billing, and cannot hold a Position. Tabs and controls a Guest may not use are shown disabled, with a tooltip that explains why.
Associate

Guest, plus may use Portfolios and their Procedures according to the Portfolio Access they have on each Portfolio. May see the Organization's People, Positions, and Catalog.
Lead

Associate, plus may create new Portfolios and edit the Organization Catalog.
Administrator

Lead, plus may add or remove Organization Members, update their Workspace Access, manage Positions, and manage billing.
Related Articles
Overview
Step-by-Step