Your company has its own copies of the standard roles — company-admin, manager, staff — created with the company and yours to edit freely: rename them, re-bundle their permissions, add your own ("Warehouse Supervisor", "Farm Manager") alongside. The copies are real: your edited Manager and another company's Manager share a name and nothing else, so one company's experiments never leak into another's.
Two edges to know. The system templates the copies are made from, and the platform's own super-admin role, live outside every company and are not yours to edit — and your copies are unaffected when the templates improve, which cuts both ways: review your copies when a module gains permissions worth having. And because a switched-off module denies its permissions to everyone (0.4), a role can hold a permission that currently does nothing — it wakes up when the module does.