<!--
  Translated by the docs agent from content-src/es/guides/equipo-roles/06-buenas-practicas-minimo-privilegio.md
  (source_hash 211b37ee2661). If that Spanish source_hash changes, re-check this translation.
-->

- **Reserve Admin for whoever genuinely needs it.** Billing, AI agents, Channels, Team and Settings —
  including the Danger zone — are sensitive areas: the fewer people with that role, the less risk of an
  accidental change.
- **Give Editor to your day-to-day operations team** — whoever handles conversations, manages leads,
  maintains the knowledge base, or works with contacts and marketing campaigns — without giving them access
  to the agency's configuration.
- **Use Read-only for anyone who only needs to see** — for example, someone who follows conversations,
  leads or analytics without acting on them.
- **Review the Members list from time to time**: check that roles still match what each person does today,
  not what they did when you invited them.
- **Suspend access as soon as someone leaves the team**, instead of waiting (section 4).