Workgroups - site settings
User roles that are allowed to create workgroups
Here you can indicate which roles are allowed to create workgroups. If no roles have been added, this means that everyone can create workgroups (default).
Default permissions when creating workgroup
Here you set which roles have standard read rights in all workgroups that are created from the moment this setting is changed.