As a root user, you can grant and revoke permissions to workspace users in the Permits tab in Settings Workspace (pinion icon).
Permissions that a user can have to the machine are:
Owner is the Role for workspace creator. Owner has got permission to every action, especially: only Owner is able to add other user with the Owner Role, only Owner is able to delete other Owner user, only Owner is able to delete the workspace, only Owner can change the workspace name.
Admin has permission to every action except the Owner permissions. Admin is able f.e. activate Regions, manage the infrastructure, add new users, change the workspace name, manage payment and billing.
The Operator is the Role only for user which is designed to manage only infrastructure of workspace (virtual machines, network, etc.).
This role allows you to view the workspace, but not to make any changes or actions.