docEvault keeps roles deliberately simple. There are two.
Member
The everyday role. Members do the actual work: create and send requests, manage contacts, review and approve documents, use templates and message sequences.
Members can read the firm-wide settings — which channels reminders go out on, the number texts come from, where client replies land, the firm's time zone and send time, and the wording of every message — but not change them. The Settings page shows those as a plain summary and names the admin to ask.
Admin
Everything a member can do, plus the account-level controls — managing the team, changing roles, billing, and the firm-wide settings under Settings: email and text delivery (including the firm's time zone and send time), where client replies go, message sequences, and branding. Admins also connect integrations: Dropbox, Box, Zapier API keys and webhooks. An admin turns Clio on for the firm, and then every member, admin or not, connects their own Clio account to send documents there.
Changing someone's role
Admins assign roles from Team, using Make Admin or Make Member in the ⋯ menu on a colleague's row. You can also choose the role when you first invite someone.
You can't change your own role. If you need to step down from admin, another admin has to make the change.
The sole-admin safeguard
You can't demote the last remaining admin. If an organization could end up with zero admins, nobody could manage the team or billing ever again, so docEvault refuses the change rather than letting you lock yourself out.
If you're the only admin, Team shows a warning until you make a second person an admin. Do that before you need it — if the only admin leaves the firm or loses access, nobody inside the organization can promote a replacement, and you'll need to contact docEvault support to restore access.
What roles don't control
Roles govern the application, not the encryption. Being an admin doesn't automatically let you read documents — that still depends on having the encryption passphrase or being granted access by someone who does. The two systems are separate on purpose.