A Heroku Enterprise team admin notices that a contractor has been granted the Member role but should only be able to view app metrics. What role change resolves this, and what access is lost?