An access profile is a named bundle of permissions — "Maintenance Control", "Inbound Service", "Read only". It is the answer to what may this job do.
It is never assigned to a person
This is the part that surprises people. You do not give an access profile to a member. You give it to a workgroup, and everyone in that workgroup inherits it.
Somebody in three workgroups holds everything all three access profiles grant, added together. Nothing is pinned to the person except access exceptions, which are for the genuinely unusual case.
What goes in one
Permissions are grouped by area — Organization & fleet, Team & access control, Stations & scope, Find providers, Agreements, Community partners, Notification templates, Collaboration, Administration. Within an area most permissions come in pairs: a view and a manage.
Design them around jobs, not around people. "Duty engineer" is a good access profile; "what Ayşe needs" is not, because the next duty engineer will need something slightly different and you will end up with two.
Administrator
Administrator grants every permission there is, now and in future. A permission added to the platform next month is included without anybody editing anything.
It also cannot be partly taken away. A "deny" exception against somebody whose workgroup carries Administrator does nothing — the platform sees Administrator and stops looking. To restrict somebody, take them out of the workgroup that grants it.
Only an owner can put Administrator in an access profile or give it to somebody. Nobody needs a workgroup carrying it to keep the organization administrable: the owners already are its administrators. The seeded Administrators workgroup is there for delegating full administration to somebody who is not an owner.
Anyone who manages access profiles without being an administrator can only add permissions they hold themselves.
Deleting one
Deleting an access profile does not delete the workgroups carrying it. Those workgroups simply grant nothing until you give them another one — which is a valid state, so nothing will look broken. Check which workgroups carry a profile before deleting it.