Beste antwoord
Build a custom role with only the permissions the job needs, and invite them to that role rather than to a general one.
For a freelancer answering DMs, that is usually:
- Read and reply in the inbox.
- See contacts in the thread they are working on.
- No billing, no contact export, no publishing automations, no team management.
Two things worth setting beyond the role itself:
- An end date in your own calendar, and remove the invite when the engagement finishes. Access that outlives the work is the most common security problem in small teams, and it is entirely a process problem rather than a product one.
- Audit visibility. Actions are logged, so if something is deleted or exported you can see who and when. Knowing that exists changes behaviour more than any permission does.
A note on what is not available: there is no built in role that sits between admin and member with a fixed shape, which is why a custom role is the answer rather than picking a preset. Build it once and reuse it for the next freelancer.
One practical warning. Giving someone inbox access means they can read every conversation, including ones from before they arrived. If some of those contain payment details or personal information a customer typed into a chat, decide whether that is acceptable before you invite, not after.
The Invite teammates and roles article covers building the role and what each permission unlocks.