Do I have to set permissions before somebody joins?
You set them on the invitation, and they see exactly what they are being given before they accept. You can change everything afterwards from Settings.
From the guide Team Permissions.
Who can change permissions
The account owner always can. You can also give a trusted teammate access to Team & permissions, and then they can manage the roster too — but they can never grant access they do not hold themselves. A leasing agent with team access cannot promote anybody, including themselves, to the company bank details. They also cannot change their own access at all; only the owner can.
Read the whole guide: Team Permissions