You get five roles and a permission matrix from the first minute.
Administrator, drive manager, finance officer, collector and viewer — each with sensible defaults you can change. Whoever records money is deliberately not the person who can reverse it.