A member is a user's seat in one account, and it carries a role: owner, admin, or member. Roles are inclusive — owner can do everything admin can, admin everything member can. Members read; admins also manage products, credentials, destinations and invites; owners also rename the account and change roles. Nobody can grant a role above their own, an admin cannot mint an owner, and the last owner cannot be removed or demoted — an account without an owner would be unmanageable.
People join by invite: an owner or admin sends one to an email address with a role attached, and accepting the link creates the membership. A pending invite can be revoked; a removed member can be re-invited.
One thing a role is not: the platform-operator (app admin) axis. That is a property of the user, grants nothing inside any account, and is managed at /system — the two never mix.