Three roles: Admin (full company control), Manager (approve team leave and timesheets without sensitive settings access), and Standard User (request leave, check in/out, view personal records).