> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Client permissions

> Which roles can view, create, edit, archive and delete clients in TimeTracker, and how supervision scope decides which clients you see at all.

Two separate checks decide what you can do with a client. Both must pass.

1. **A capability** – may you do this at all?
2. **Your supervision scope** – to which clients does it apply?

A capability without reach shows you nothing. Reach without the capability refuses the action.

## The two client capabilities

| Capability      | What it allows                                                                                     |
| --------------- | -------------------------------------------------------------------------------------------------- |
| `client.view`   | Open the **Clients** page, read the client list, open a client's details – read only               |
| `client.manage` | Everything in `client.view`, plus create, edit, archive, delete, restore, and manage portal access |

`client.manage` is a superset. Holding it means you never also need `client.view`.

## Which roles hold them

| Role                | `client.view` | `client.manage` |
| ------------------- | ------------- | --------------- |
| **Owner**           | Yes           | Yes             |
| **Admin**           | Yes           | Yes             |
| **Project Manager** | Yes           | Yes             |
| **Finance**         | Yes           | No              |
| **Member**          | No            | No              |
| **Contractor**      | No            | No              |
| **Client**          | No            | No              |

These are the seeded defaults. A workspace can build custom roles that mix them differently – see [/team/custom-roles](/team/custom-roles).

<Note>
  Finance can read clients but not change them. That is the split by design: Finance owns money surfaces – invoices, payments, exports – not the client record itself.
</Note>

## Scope decides which clients

Holding `client.view` does not mean you see every client.

**Client reach is derived from project reach.** You see a client when you can see at least one of that client's projects.

| Your role's supervision scope             | Clients you see                                            |
| ----------------------------------------- | ---------------------------------------------------------- |
| **Everything in the workspace**           | Every client                                               |
| Their projects, and people on them        | Only clients behind projects they manage or are staffed on |
| Their projects, and people in their group | Same – a group grants no project it is not staffed on      |
| Their projects, and only their own data   | Same                                                       |

Owner, Admin and Finance are seeded at workspace scope, so they see every client. Project Manager is seeded at project scope, so a PM sees the clients behind their own projects.

Full detail at [/concepts/supervision-scope](/concepts/supervision-scope).

<Tip>
  There is no separate "client scope" setting. One enum answers both "which people" and "which projects", and clients follow projects. A second setting would drift and let someone see every client but none of their projects.
</Tip>

## What each capability unlocks on screen

<Tabs>
  <Tab title="No client capability">
    * **Clients** still appears in the sidebar if the app is on, but the page shows *"Clients are hidden for your role"*.
    * A direct link to a client shows *"This client is hidden for your role"* with a **Back to workspace** button.
  </Tab>

  <Tab title="client.view only">
    * The client list loads, with the search box, sorting, scope filter and pagination.
    * There is **no** **Add client** button.
    * A client's page opens with every field disabled and the footer *"You have view-only access to this client."*
    * There is no **Actions** menu and no **Portal access** panel.
  </Tab>

  <Tab title="client.manage">
    * **Add client** appears.
    * Every field is editable, with **Save changes** and **Reset changes**.
    * The **Actions** menu offers Archive, Restore, Delete and Delete permanently.
    * The **Portal access** panel appears, so you can invite contacts.
  </Tab>
</Tabs>

## Related capabilities

Some things on a client page are governed elsewhere.

| Control                                   | Capability                                          | Why                               |
| ----------------------------------------- | --------------------------------------------------- | --------------------------------- |
| Tick or untick a contact's project access | `project.manage`                                    | It grants access to a **project** |
| See a client's projects in the list       | `project.manage` is not required – project reach is | Reach, not capability             |
| Set a project's client                    | `project.manage`                                    | The link lives on the project     |

## App and plan gating

**App gating.** Clients live inside the **Projects & tasks** app. Switch it off in **Settings → Apps** and the **Clients** page is hidden and its URL stops working. Nothing is deleted. See [/concepts/apps-and-modules](/concepts/apps-and-modules).

**Plan gating.** Projects & tasks is on every plan, including Free. The **client portal** is a Pro feature, so on Free the Portal access panel is behind a paywall. See [/concepts/plans-and-features](/concepts/plans-and-features).

<Warning>
  An app that is **off** is hidden entirely. A feature that is **not on your plan** stays visible and shows a paywall. These are different states – do not read one as the other.
</Warning>

## Example

At Northwind Studio:

* **Maya Ellis (Owner)** and **Tom Whitfield (Admin)** hold `client.manage` at workspace scope. They see and edit all four clients.
* **Priya Raman (Project Manager)** holds `client.manage` at project scope. She manages the two Bluebird Coffee projects and Harbor Logistics' Mobile App, so she sees those two clients. Fenwick Legal is invisible to her – nobody staffed her on Brand Refresh.
* **Daniel Okafor (Finance)** holds `client.view` at workspace scope. He reads every client's billing address and tax ID for invoicing, but the fields are greyed out.
* **Sarah Lin (Member)** and **Ana Ferreira (Contractor)** hold neither. The Clients page refuses them.
* **Ruth Castillo (Client)** holds zero internal capabilities. She never sees the internal app at all – only the portal.

## What happens if permissions change mid-session

TimeTracker checks capabilities live. If an admin removes **Manage clients** while you have a client page open, the write controls disappear on the next update and the server refuses the save. You do not need to sign out and back in.

## Common questions

<AccordionGroup>
  <Accordion title="Can I give a Member read access to clients?">
    Yes. Build a custom role that adds `client.view`, or add the capability to the Member role. See [/team/custom-roles](/team/custom-roles).
  </Accordion>

  <Accordion title="Can I let a Project Manager see every client?">
    Widen the role's supervision scope to **Everything in the workspace**. Be aware that this also widens their reach over people and projects – scope governs both halves.
  </Accordion>

  <Accordion title="Why can Finance see clients but not edit them?">
    Because Finance owns the money surface, not the client record. If your Finance lead also maintains client records, add `client.manage` to a custom role.
  </Accordion>

  <Accordion title="Can a contractor ever see clients?">
    Only if you add `client.view` to their role. By default Contractor is the narrowest staff role and cannot see clients or build reports.
  </Accordion>

  <Accordion title="Does a portal contact see the client record?">
    No. A portal contact sees shared projects, not the billing record of their own company.
  </Accordion>
</AccordionGroup>

## Troubleshooting

| Problem                                 | Cause                                     | Fix                                                 |
| --------------------------------------- | ----------------------------------------- | --------------------------------------------------- |
| "Clients are hidden for your role"      | No `client.view` and no `client.manage`   | Ask an admin to add **View clients**                |
| The list is empty but clients exist     | Your scope reaches none of their projects | Get staffed on a project, or widen the role's scope |
| **Add client** is missing               | You hold `client.view` only               | Ask for **Manage clients**                          |
| Fields are greyed out                   | Same                                      | As above                                            |
| **Clients** is missing from the sidebar | The Projects & tasks app is off           | Turn it on in **Settings → Apps**                   |
| A client vanished after a role change   | Your reach narrowed                       | Check your role's supervision scope with an admin   |

## Related guides

<CardGroup cols={2}>
  <Card title="Roles and capabilities" icon="shield" href="/concepts/roles-and-capabilities">
    All seven roles and 66 capabilities.
  </Card>

  <Card title="Supervision scope" icon="eye" href="/concepts/supervision-scope">
    The "over whom" half of access.
  </Card>

  <Card title="Custom roles" icon="user-cog" href="/team/custom-roles">
    Build a role that fits your team.
  </Card>

  <Card title="Apps and modules" icon="toggle-left" href="/concepts/apps-and-modules">
    What switching an app off does.
  </Card>

  <Card title="Project permissions" icon="folder-lock" href="/projects/project-permissions">
    The same model, for projects.
  </Card>
</CardGroup>