Skip to main content
Two separate checks decide what you can do with a client. Both must pass.
  1. A capability – may you do this at all?
  2. Your supervision scope – to which clients does it apply?
A capability without reach shows you nothing. Reach without the capability refuses the action.

​
The two client capabilities

client.manage is a superset. Holding it means you never also need client.view.

​
Which roles hold them

These are the seeded defaults. A workspace can build custom roles that mix them differently – see /team/custom-roles.
Finance can read clients but not change them. That is the split by design: Finance owns money surfaces – invoices, payments, exports – not the client record itself.

​
Scope decides which clients

Holding client.view does not mean you see every client. Client reach is derived from project reach. You see a client when you can see at least one of that client’s projects. Owner, Admin and Finance are seeded at workspace scope, so they see every client. Project Manager is seeded at project scope, so a PM sees the clients behind their own projects. Full detail at /concepts/supervision-scope.
There is no separate “client scope” setting. One enum answers both “which people” and “which projects”, and clients follow projects. A second setting would drift and let someone see every client but none of their projects.

​
What each capability unlocks on screen

  • Clients still appears in the sidebar if the app is on, but the page shows “Clients are hidden for your role”.
  • A direct link to a client shows “This client is hidden for your role” with a Back to workspace button.
Some things on a client page are governed elsewhere.

​
App and plan gating

App gating. Clients live inside the Projects & tasks app. Switch it off in Settings → Apps and the Clients page is hidden and its URL stops working. Nothing is deleted. See /concepts/apps-and-modules. Plan gating. Projects & tasks is on every plan, including Free. The client portal is a Pro feature, so on Free the Portal access panel is behind a paywall. See /concepts/plans-and-features.
An app that is off is hidden entirely. A feature that is not on your plan stays visible and shows a paywall. These are different states – do not read one as the other.

​
Example

At Northwind Studio:
  • Maya Ellis (Owner) and Tom Whitfield (Admin) hold client.manage at workspace scope. They see and edit all four clients.
  • Priya Raman (Project Manager) holds client.manage at project scope. She manages the two Bluebird Coffee projects and Harbor Logistics’ Mobile App, so she sees those two clients. Fenwick Legal is invisible to her – nobody staffed her on Brand Refresh.
  • Daniel Okafor (Finance) holds client.view at workspace scope. He reads every client’s billing address and tax ID for invoicing, but the fields are greyed out.
  • Sarah Lin (Member) and Ana Ferreira (Contractor) hold neither. The Clients page refuses them.
  • Ruth Castillo (Client) holds zero internal capabilities. She never sees the internal app at all – only the portal.

​
What happens if permissions change mid-session

TimeTracker checks capabilities live. If an admin removes Manage clients while you have a client page open, the write controls disappear on the next update and the server refuses the save. You do not need to sign out and back in.

​
Common questions

Yes. Build a custom role that adds client.view, or add the capability to the Member role. See /team/custom-roles.
Widen the role’s supervision scope to Everything in the workspace. Be aware that this also widens their reach over people and projects – scope governs both halves.
Because Finance owns the money surface, not the client record. If your Finance lead also maintains client records, add client.manage to a custom role.
Only if you add client.view to their role. By default Contractor is the narrowest staff role and cannot see clients or build reports.
No. A portal contact sees shared projects, not the billing record of their own company.

​
Troubleshooting

Roles and capabilities

All seven roles and 66 capabilities.

Supervision scope

The “over whom” half of access.

Custom roles

Build a role that fits your team.

Apps and modules

What switching an app off does.

Project permissions

The same model, for projects.