Only the Account Owner may setup and manage Account User access credentials. Account owners are the only user able to enable/disable user access and update the account's address and contact information on their behalf.
Admin users have the most privileges, after the Account Owner. They cannot change the primary account's contact details, but they may manage payments and configure service settings.
Finance users have access primarily to billing functions of the account. In addition to registering, renewing, transferring in domain names, they may purchase additional services. The finance user can manage the payment and auto-renewal settings. They do not have access to domain and services configuration.
Tech users can update configurations to domains and other account services. They may register, renew, transfer in domain names. They may make purchases, but cannot add or modify available billing accounts or invoice settings.