What are the differences between course-level roles and account-level roles?
Course-level roles are roles with permissions set at the course level. Usually these roles cannot see more than what is in the course.
Canvas provides five base roles that each include a set of default permissions. You can change the permissions according to the access you want to grant users in each role. You can also create custom course roles that are created from a base role:
- Students  have the ability to submit assignments and that should never be taken away from them. Students have some restricted permissions, but they have enough permissions to use Canvas. Sometimes students may have other permissions bestowed upon them, if the an admin gives them more permissions.
- TAs  are very similar to teachers in the sense of permissions, except TAs should not have access to SIS data. TAs are meant to help the teacher and provide support. Admins can grant certain permissions to TAs, like grading, or not allow the TA to grade. It depends on the institution and what the needs are.
- Depending on the institution, teachers  can have almost account-level permissions, or very little permissions. Teachers are basically course admins and have control over the course. However, like all the roles, they can be used as a different type of user, if needs be.
- Designers  should have access to at least using the course content, creating discussions, announcements, assignments, quizzes, and other content filled features. Some designers will have more or less permissions than teachers when it comes to student information. Designers cannot access grades. However, if your institution does not use Course Designers, you could use this user role as another TA user role that has more permissions than the regular TA.
- Observers  can be linked to a student enrolled in a course. For example, parents, guardians, and/or mentors may wish to be linked to a student to view the student’s progress in the course. Usually observers have the least amount of permissions.
Account admins have the power to set permissions for all users in Canvas. Admins can create additional account-level roles with various permissions at the account level. The default permissions for account admins can include access to everything within the account, plus the ability to masquerade as a user.
Each sub-account has its own permissions page, so admins can create account-level roles within a sub-account and add sub-account permissions directly within the sub-account. Sub-account admins can only be admins for the sub-accounts to which they've been assigned. Sub-account admins will most likely receive the same permissions as account admins, but they will only have power over the sub-account assigned to them. The default permissions for a sub-account admin will vary between accounts.