Every administrator has their own account, and every account carries a role: a named set of 181 permissions, grouped by area.
- Invite administrators by email; they set their own password on a page of their own.
- Start from the narrowest role that could do the job, not a copy of the full administrator.
- A permission not granted hides the page: it is absent from the menu and refuses a direct link.
- Test a role by signing in as an account that holds it. Reading the checkboxes is not a test.
Keep two full administrators
One super-administrator whose password or phone is lost is an outage. Check the second one can actually sign in.
Shared logins destroy the audit trail
The admin log can only tell you who did what if everybody signs in as themselves.
Full guide
The complete reference is Team, roles, and access in the WBAMS documentation.