When you begin to add customization to the out-of-the-box system, it's wise to think about the different types of users that will use your system, and how their roles might impact the amount of data that is available to them in the system. It's always a best practice to only give users access to data or features that they actually need to use. Giving a user access to anything additional can complicate their workflow or potentially cause conflicts. In order to regulate this, Agiloft users belong to Groups and Teams, and are given specific Roles. 

• Group settings affect the level of access to tables, records, and fields. Users in multiple groups receive the superset of those groups' access settings. For easier system maintenance, it's recommend to keep the number of groups relatively small.
• Team settings affect other parts of the End User Interface such as the color scheme, available views, and the default home page. Teams also define collections of users, and can be used as an email recipient to send emails to every member of the team. Users can join multiple teams, but must always have a Primary Team. 
• Roles are used to combine the appropriate Group and Team in order to determine a user's permissions level, as well as the notifications they can receive. They also flag whether or not the Employee uses an assigned license.

For more information on these concepts, visit their respective pages.