Roles and permissions
A role is a set of permissions given to a login. It answers what a login may do; what a person or company is to the agency (client, prospect) is a separate classification on the contact and company. Every login holds at least one role.
What you can do
- Give each team member one or more roles on the Team screen.
- Make new roles, and choose their permissions, in Ops & admin > Access > Roles.
- Archive and restore roles.
Built-in roles
| Role | For | Can |
|---|---|---|
| admin | Running the workspace | Everything, including Team, Roles, Labels, Task priorities, Company, Companies and Contacts, Integrations and Bots |
| manager | Running projects | Projects and task lists, tasks and time, docs including publishing, reports, metrics, the Team list (read only) |
| developer | Delivery staff | Dashboard, My Stuff (Today, Tasks, Activity), Projects, Support (Tickets) and the Schedule. No Docs, SEO, canvases or agent tools |
| ops | Running servers | Everything a developer sees, plus Ops & admin: Health, Email (Templates, Sent mail), Plugins, Imports, Collector tokens and View as. No Roles, Delegations, agent tools, AI, Docs publishing, Bots or Agent Sessions |
| marketing | Marketing staff | Dashboard, My Stuff, Projects, Companies and Contacts (read-only), the Marketing screens and the Schedule. No Docs, canvases or agent tools |
| qa engineer | Testing staff | Read projects; create and edit tasks; log time; write docs |
| designer | Design staff | Read projects; create and edit tasks; log time; write docs |
| staff pilot | Staff on a trial of the app | Projects, tasks and time, and the Schedule; no reports or dashboard cards |
| staff limited | Staff on the Schedule only | The Schedule; no tasks |
| bookkeeper | Finance staff | Metrics and the Schedule |
| client | A client's login | Own client dashboard, with hours per project per month and no money; read their projects, tasks, time and comments; add comments and tasks; read docs shared with them; a read-only Timeline |
| client limited | A client's login, docs only | Read docs shared on their projects |
| bot | A bot account | Projects and task lists it is given, tasks, time, docs, labels, and reading companies and contacts |
An account with no team role, or the attribution only role, keeps its name on past work and has no permissions.
Permissions
| Group | Permissions |
|---|---|
| Team | view team, view team rate, create team member, edit team member, archive team member, restore team member |
| Label | view labels, create label, edit label, archive label, restore label |
| Task Priority | view task priority, create task priority, edit task priority, delete task priority, restore task priority |
| Role | view roles, create role, edit role, archive role, restore role |
| Owner Company | view owner company, edit owner company |
| Contact | view contacts, create contact, edit contact, archive contact, restore contact |
| Company | view companies, create company, edit company, archive company, restore company |
| Project | view projects, view project, create project, edit project, archive project, restore project, edit project user access |
| TaskGroups | create task group, edit task group, archive task group, restore task group, reorder task group |
| Tasks | view tasks, create task, edit task, archive task, restore task, reorder task, complete task, add time log, delete time log, view time logs, view comments |
| Reports | view all time report, view client reports |
| Activities | view activities |
| Integrations | view integrations, manage integrations |
| Workflows | view workflows, manage workflows |
| Metrics | view business metrics, view delivery metrics |
| Capacity | view schedule, view capacity, manage schedule |
| Docs | view articles, create article, edit article, archive article, restore article, publish article, manage knowledge |
| Bots | manage bots |
| Feedback | send feedback |
Plugins add their own groups, for example Leads. See Plugins.
How to
Roles:
- Open Ops & admin > Access > Roles. The list shows Name and Permissions count.
- Press Create. Fill Name, tick the permissions, and press Create role.
- To change a role, press Edit, change Name or permissions, and press Update.
- Archive a role from its row; choose Archived to restore it.
Team:
- Open Team in the sidebar. Filter Active, Archived or No team role. Columns: Team member, Role,
Email, Last active, and Rate for holders of
view team rate. - Press Create. Fill Name, Job title, Phone, Hourly rate, Roles and Profile image, and Email under Login credentials. Press Create user.
- The new member gets an email, "Your account is ready", telling them to sign in with single sign-on.
- On Edit, Hide this person's time from reporting keeps their time logged but leaves it out of the delivery dashboard, the time reports, the over-budget report and every hours total.
- Archive a team member from their row, and restore them from Archived.
Limits
- The admin role cannot be edited or archived.
- Roles is admin-only: only an admin sees Roles, under Ops & admin > Access. Ops does not.
- Developer, ops and marketing have no Docs (every Docs screen, the Docs API and the Docs agent tools are refused), no canvases other than the daily note, and no API tokens, My AI, Connections agent setup, Integrations, Delegations or agent tools. The other staff roles have them.
- The bot role is never offered on the Team screen; bots are made in Ops & admin > Agents > Bots.
- Clients see only the projects their access allows: a client contact at a client company, or a project they were added to. Tasks marked hidden from clients stay hidden. See Contacts.
- Clients and client limited logins cannot use Docs (they read shared docs only), personal API tokens, Integrations, the Agent panel or Docs publishing.
- Bookkeepers cannot hold personal API tokens or connect Nextcloud, and cannot pick Local (Ollama) in the Agent panel.
- Personal API tokens are for staff only: not clients, contact logins, bookkeepers or bots. A bot's tokens are issued by an admin in Ops & admin > Agents > Bots.
- A bot sees only the projects it is given, and cannot change who sees a project.
- A permission added to a role applies to everyone holding it, at once.