[team account - restrict by policies]

hi

i'm new to team account

is there a way for me to create a user for an end customer, and limit that user so he'll be able to do only specific actions on the agent?

i've found the policies, which i've seen i can make those limitations there. and i've found that i can apply those policies to a site, an organization or an agent group. but how can i apply them so they limit the user via those policies? i could only find team permissions but it's only full/no/read only - nothing in between

what am i missing here? thank you