An account is the tenant — the workspace everything else lives inside. Every URL in the app starts with the account's slug (an opaque identifier, deliberately not derived from the name, so it survives renames and leaks nothing). There are two kinds: a personal account, created automatically with every user, and team accounts, created on demand — a user can belong to any number of either.
Membership is what grants access: non-members get a 404, not a 403, because to them the account does not exist. Inside, what you may do is your role — see the member concept. An account can be suspended by a platform operator: it stays readable but every write is refused, whatever your role.
Related: Member & roles · API token