Approval permissions

Approving needs three things to line up – the capability for that domain, a supervision scope that reaches the person, and, for most actions, a Pro plan.

​

The four approve capabilities

Each domain has its own. Holding one never grants another. The Approvals page shows one tab per domain you can approve. One capability means one tab. No capabilities at all means “You do not have access to approvals.” Finance holds expense.approve and nothing else in that table. Expenses are a money surface; the other three are delivery decisions.

​

The supporting capabilities

Approving is rarely the only thing a reviewer needs.

​

The pattern behind the tiers

Three tiers, and each one has a reason.

​

Capability is not scope

Holding time.approve does not mean you see every submission in the workspace. Your queue is derived from both, plus yourself. Every submission from a person your scope reaches appears, and so do your own. See /concepts/supervision-scope for how scope is set.

​

Self-approval

Your own submitted period appears in your own queue. This is an explicit product decision, and it applies to timesheets and timecards alike. If your workspace does not want that, do not grant the approve capability to people who also submit.

​

Plan gating

The plan gate is separate from the capability gate, and it runs last. The asymmetry is deliberate. Granting an approval is resolution, and resolution is what Pro sells. Taking one back must work on every plan – a workspace whose subscription lapses mid-week would otherwise be stuck holding a decision it can neither complete nor undo. On the Free plan the Approvals page shows a blurred page shape with an upgrade card over it. Inside the queue, the Approve and Reject… items stay listed and carry a Pro badge – a menu item that vanishes reads like a bug, and this is the exact moment the work on screen is worth the most.

​

App gating

Each tab also needs its app switched on in Settings → Apps. An app that is off removes its tab completely, and the sidebar badge stops counting it. A feature not on your plan keeps the surface visible behind a paywall. They are different things – see /concepts/apps-and-modules.

​

Example

Northwind Studio’s approval setup. Priya’s sidebar badge counts only her people. When Ana submits a week for a project Priya does not run, it goes to Tom instead. When Bluebird Coffee queries an invoice after month end, Priya cannot reopen the closed period. Daniel posts an adjustment instead – the one correction route that survives a close.

​

Custom roles and per-person overrides

The tables above are defaults. Your workspace can change them.

• Custom roles – build a role with exactly the capability set you want. See /team/custom-roles.
• Per-person overrides – deny a specific capability to one person, even though their role has it. See /team/per-person-permissions.

One capability can never be moved: deleting the workspace stays with the Owner role, no matter what.

​

Common questions

​

Troubleshooting

• “You do not have access to approvals.” No approve capability for any switched-on app.
• “You can’t approve time.” Your role lacks time.approve, or the workspace is on Free.
• “You can’t reopen an approved timesheet.” time.reopenApproval is Owner and Admin only.
• “You can’t post an adjustment.” You do not hold time.adjust.
• A button shows a Pro badge. You have the capability but not the plan.
• A whole tab is missing. Its app is switched off, or you lack that domain’s approve capability.

​

Related guides