A role decides which pages that person is offered at all — the buttons in the header of every page are drawn from it, and the API refuses the request behind any button that is not there, so the two cannot drift apart. Every account anybody reaches comes from the account mapping, worked out when the request is made: the accounts it files under the person's name, as AM or SA, and every account under any FLM team ticked on their row. So an account changing hands moves with the mapping and nobody has to come back here. The name has to be spelled the way the mapping spells it; a row whose name is on no account and has no team ticked sees nothing.
The alias is what the sign-in proves, so it is the only column that decides anything — the name beside it is for reading. An alias missing from here gets the default role at the bottom of this card. The Scope column says how many accounts that row comes to; click it to see which, or to tick teams.
Aliases that have opened the tracker and matched no row above. Their sign-in proves the alias, which is the one thing this page cannot work out for itself — pick the person they are and the alias is filled in for you. Being on this list grants nothing: until you save them onto a row they get the default role.
Everyone the mapping names as an AM, FLM or SA who has no row above. Adding one puts the name in, scoped to what the mapping already says they own — you still have to fill in their alias, because that is what the sign-in proves.
Every read and write on this page goes through the credit API, which checks this roster for itself. Hiding a button here is a courtesy; the refusal is server-side. Internal — do not share outside AWS.