Last I checked, it wasn't possible to grant permissions to (for example) a marketing employee who you don't also want permission to edit DNS records.
Edit: I see "Role based account access" is a feature of their "Enterprise" / "request pricing" tier...