Everyone in a workspace holds one licence and one role. The licence decides which interface they sign in to; the role decides what they may do in it.
The two licences
Console is the Management Console: the full workspace, for the people who run it.
Portal is the Employee Portal: a person's own work, requests and records, for everyone else.
Everyone on a Portal licence is a member of your workspace. There is no seat for people outside your organisation.
The five roles
Owner (Console). The billing and ultimate-authority account. Exactly one per workspace; it cannot be demoted or duplicated.
System Admin (Console). Full administration of the workspace short of billing. Only an Owner or another System Admin can appoint one.
Admin (Console). Day-to-day administration. Starts on a sensible set of permissions; switch them to custom access to grant exactly what is needed.
Employee (Portal). A member of staff responding to work addressed to them.
Participant (Portal). The same portal access as an Employee, with one exception: a Participant cannot pre-register a visitor. Use it to tell apart people who take part in workflows from those who also host guests on site.
Changing someone's licence or role
Open People & access, find the person and choose the edit button on their row. The licence and role are on the form with their other details. A change takes effect on their next request; nobody has to sign out.