Who can manage roles and permissions?

Managing roles, members' permissions and team settings requires Manage in the Settings module; by default the owner and the Admin role hold it. Nothing can take the owner's permissions away, so a team is never left without someone to manage it, and anyone who is not the owner cannot remove this permission from themselves.