The administrator of a workspace (i.e. the person who set up OC for a company) has full rights, which cannot be changed in the user administration either. However, other employees can be assigned administrator rights for certain groups. It makes sense to give these rights to project managers, department managers etc. Make sure that the system rights are adjusted accordingly. In this case at least the role administration, reports with own and all data, user administration and invite new system users should be selected. Then edit the role Administrator. It makes sense to grant the administrator all rights here.

The majority of your employees will probably get membership rights. To get the most out of OC, at least the following requirements are recommended: 

As system privileges, members should at least have access to time tracking and read reports with their own data. At group level, all delete functions should be disabled. Other settings, however, could be allowed.

External employees such as freelancers should be assigned different rights than permanent employees in a company. You can group these employees under the role Externals. They also need certain minimum rights in order to be able to use OC optimally in everyday work.

To be able to record their time, external employees also need the system authorization Access to time recording. They should also be able to read reports containing their own data. The rights at group level are relatively limited. Here, this category of employee would need at least the rights to create a new task and to record time.

For certain projects it makes sense to invite a customer to a board or group. This allows the customer to directly follow the progress of the work commissioned. However, there should be no rights other than the right to view the tasks.