Everyone in an organization has exactly one role, and that role decides what they can see and do. If someone is missing a page or a button, the role is usually the reason.
The four built-in roles
- Admin: everything. Settings, billing, pay rates, every member's time. Give it to the one or two people who run the organization.
- Project Manager: runs projects and the people on them, covering projects, tasks, the team's time and the reports for it. No organization settings, no billing.
- Member: the everyday role. Tracks time, works the board, sees their own timesheet and their own screenshots.
- Client: read-only, for clients and auditors. Sees only the projects they have been attached to, and does not use up a member seat.
These four are built in. You cannot edit or delete them, which stops a role everyone depends on being changed by accident. If none of them fits, build a custom role instead.
Permissions are per action
A role is a list of specific permissions: view members, create projects, edit tasks, generate invoices, and so on. That is why access is so granular. Someone can be allowed to view time without editing it, or to see invoices without marking them paid.
Scopes: whose data, not which action
Many permissions carry a scope as well as an action. The scope answers "whose?".
- Own: only their own. Their timesheet, their tasks.
- Team: their own plus their team's.
- All: everyone in the organization.
So "view time, Own" and "view time, All" are the difference between a member and a manager, using the same underlying permission. A scope can never exceed the parent permission's scope: you cannot grant editing across the whole organization if viewing is limited to their own.
Why someone cannot see something
Check in this order:
- Role. Does their role include the permission at all? This is the answer four times out of five.
- Scope. They may hold the permission but only over their own records.
- Project membership. Project-scoped data needs them on the project, whatever their role.
- Plan. Some features are tied to the subscription. Those show a lock and an upgrade link instead of vanishing.
Changing someone's role
Edit the member and pick a different role. It takes effect immediately, and they may need to reload the page. Nothing they created is affected, only what they can reach from now on.
Two things to know
- The organization owner always has full access, whatever role is set. That is what stops an organization locking itself out.
- Client is not "a member with less". Its access comes from which projects you attach the person to, not from a permission list.