Access described, not assumed
You create roles yourself and decide what they cover: who sees rates, who closes the month, who manages the team, who only handles their own tasks. Default roles are protected against accidental deletion, and module permissions are added to them automatically when a module is enabled for the company.
Several companies, one user
The same person can belong to the agency and to several client companies, with a different role in each. Switching companies switches the whole context - tasks, settlements, chat and permissions. A closed module takes away access to its features, but does not delete data or lose the granted permissions when it comes back.