Workspace roles define who can administer access, manage usage, and perform governed actions in EM3A.