Team — admin

Who opens it: an Owner or Admin adding somebody, or changing what somebody may do.

What they came to do: invite a colleague with the right role, or change or remove one.

True when they leave: everybody on the team can do their job and nothing more, and every change is on the record.

Decisions already made

A role, and sometimes a group. A role limited to one group (Group Lead, Check-in Staff, any custom role set that way) is never given without a group — at invitation, at a role change, and never as single sign-on's default (roles.md). That is L18: a person who can scan always has a group or a check-in point.
Nobody can give away more than they hold. An invitation, a role change and a new role are all checked against the inviter's own permissions, so an Admin cannot make themselves an Owner by a detour.
Billing stays with the Owner. tenant.billing is not a permission any other role can be given.
Seats are counted, and the plan's seats_max is enforced here. An invitation that would go over the seat count is refused with the number, not with a key.
An invitation is a link with a life. It names the role and the group it was sent for; accepting it is what makes a membership, and the invitation cannot be edited into a different role after it was sent.
Disabling, not deleting. A disabled member keeps their name against everything they did. Their sign-in stops working immediately, on every host.
Single sign-on does not bypass any of this (single-sign-on.md): a colleague signing in with a work account for the first time is added with a chosen role, never as Owner, and only while seats last.

There is no way to see what one member has actually been doing from this screen; that is the audit log, filtered by actor.
Two Owners is the only way to survive one Owner leaving, and nothing here says so.