> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.
# Roles and permissions
> How TimeTracker decides who can do what – the seven roles, the capabilities behind them, custom roles, and per-person permission overrides.
TimeTracker decides what you can do using two things: a **role** and the
**capabilities** inside it.
A role is a named bundle, like Project Manager. A capability is one named
permission inside that bundle, like "approve time". You get a role. The role gives
you capabilities. Every button in the product checks a capability before it appears.
## The seven roles
Every workspace starts with these seven. You can also build
[custom roles](/team/custom-roles) from the same capability list, and all but two of
the seven can be edited or renamed to fit your team.
| Role | Who it is for | The short version |
| ------------------- | -------------------------------- | -------------------------------------------------------------- |
| **Owner** | The person who owns the business | Everything, including deleting the workspace. |
| **Admin** | Operations lead | Everything except deleting the workspace. |
| **Project Manager** | Delivery lead | Clients, projects, tasks, approvals, budgets and invoices. |
| **Finance** | Bookkeeper or finance manager | Invoices, payments, expenses and exports. Not delivery. |
| **Member** | A regular employee | Tracks time, works tasks, submits their own week. |
| **Contractor** | A freelancer | Like Member, but no client visibility and no report building. |
| **Client** | An external client contact | Zero internal permissions. Sees only their own company's work. |
For the exact capability-by-capability grid, see the
[roles and permissions matrix](/reference/roles-and-permissions-matrix).
## How the roles rank
Most of the roles form a clean ladder, where each one holds everything the role below
it holds:
`Owner (66) → Admin (65) → Project Manager (43) → Member (16) → Contractor (12) → Client (0)`
The number is how many of the 66 capabilities that role carries.
**Finance sits off to the side, not on that ladder.** It holds 14 capabilities, all of
them also held by an Admin – but it is **not** a wider version of Member. A Member can
create tasks, track time and build reports. Finance cannot do any of those.
| | Member | Finance |
| --------------------- | ------ | ------- |
| Track and submit time | Yes | **No** |
| Create and edit tasks | Yes | **No** |
| Build reports | Yes | **No** |
| Invoices and payments | No | **Yes** |
| Approve expenses | No | **Yes** |
| Export data | No | **Yes** |
So Finance is a **specialist** role, not a senior one. If Daniel also needs to track
his own hours, give him a [custom role](/team/custom-roles) that adds `time.track` –
do not assume Finance already includes it.
Two other things worth knowing:
* **Owner and Admin differ by exactly one thing.** An Admin can do everything an
Owner can, except delete the workspace. That is irreversible, so it stays with the
Owner alone.
* **Project Manager and Finance are siblings, not ranked.** Priya (Project Manager)
runs delivery. Daniel (Finance) runs the money. They overlap on invoices and
expenses, and that is deliberate.
A **Client** holds an empty capability set. That is not an oversight – a portal
contact is not a member of your team. They see only what is shared with their
client company. See [what clients can see](/portal/what-clients-can-see).
## Capabilities
A capability is a single named permission such as `time.approve` or
`invoice.manage`. There are 66 of them, grouped by area:
| Area | Examples |
| ------------------ | -------------------------------------------------------------------- |
| Workspace | `workspace.updateSettings`, `workspace.delete` |
| People | `member.invite`, `member.changeRole`, `member.remove`, `role.manage` |
| Clients | `client.view`, `client.manage` |
| Projects and tasks | `project.manage`, `task.create`, `task.edit`, `task.bulkEdit` |
| Rates | `rate.manage`, `rate.viewBilling`, `rate.viewCost` |
| Time | `time.track`, `time.approve`, `time.viewOthers`, `period.close` |
| Money | `budget.manage`, `invoice.manage`, `payment.record` |
| Expenses | `expense.submit`, `expense.approve` |
| Time off | `leave.request`, `leave.approve`, `leave.viewOthers` |
| Reports | `report.view`, `report.create`, `report.export`, `report.schedule` |
| Time Clock | `timecard.clock`, `timecard.approve`, `timecard.reopen` |
| Planner | `block.manage`, `block.manageOthers` |
| Admin | `billing.manage`, `webhook.manage`, `data.export`, `location.manage` |
The [capabilities reference](/reference/capabilities) lists all 66 with a plain
description of each.
## A capability is not a scope
This is the single most misunderstood part of the permission model, so it is worth
slowing down.
* A **capability** answers: *may you do this at all?*
* A **supervision scope** answers: *for whom?*
Both have to pass.
**Example.** Priya is a Project Manager, so she holds `time.viewOthers`. That does
not mean she sees everybody's hours. She sees the hours of the people in her scope.
If Jonas is not in her scope, Priya has the permission but not the person.
If someone says "I have permission but I still cannot see it", the answer is almost
always scope. See [supervision scope](/concepts/supervision-scope).
## Custom roles
If none of the seven fit, an Admin or Owner can build a custom role by picking
capabilities from the same list. A workspace might create "Studio Lead" – a Member
who can also approve time.
You can also edit five of the seven built-in roles directly. **Owner and Client are
locked**; Admin, Project Manager, Finance, Member and Contractor can be renamed and
have their capabilities changed to fit how your business actually works.
Two limits apply:
* **Owner-exclusive actions cannot be granted.** Deleting the workspace stays with
the Owner no matter what role you build. It is never offered as a checkbox.
* **A custom role can only combine existing capabilities.** It cannot create a new
kind of permission.
You need `role.manage`. See [custom roles](/team/custom-roles).
## Per-person exceptions
Sometimes one person is the exception. Rather than building a whole role for them,
you can adjust them individually.
**Per-person exceptions are subtractive only.** They take something away. They can
never grant a person something their role does not already include. If you need to
grant, change the role or build a custom one.
Today this is exposed as one switch: **Clock in and out**, on a person's record.
**Example.** Everyone on the team can clock in and out, but Ana is a contractor who
bills by the deliverable and should not use the clock. Switch clock access off for
Ana alone, and leave everyone else untouched.
[Location rules](/location-rules/overview) act as a second subtractive layer – they
block an action based on where someone is, without changing their role.
See [per-person permissions](/team/per-person-permissions).
## How the checks stack up
When you open a page, four separate gates run. They fail in different ways, and
telling them apart saves a lot of support time.
| Gate | Question | What you see if it fails |
| -------------- | ------------------------------------------ | ---------------------------------------------------------- |
| **App** | Is this app switched on for the workspace? | Nothing. The area is hidden and gone from the sidebar. |
| **Plan** | Does the plan include this feature? | The area stays in the sidebar and shows an upgrade screen. |
| **Capability** | Does your role allow this action? | The button is missing or disabled. |
| **Scope** | Is this person or project in your scope? | The page loads, but that record is not in it. |
When someone reports a missing feature, ask which of the four it is before changing
anything. The decision tree is on
[I cannot see a feature](/troubleshooting/i-cannot-see-a-feature).
## Who can change permissions
| Action | Capability | Roles that hold it by default |
| --------------------- | ------------------- | ----------------------------- |
| Invite a member | `member.invite` | Owner, Admin, Project Manager |
| Change someone's role | `member.changeRole` | Owner, Admin |
| Remove a member | `member.remove` | Owner, Admin |
| Build a custom role | `role.manage` | Owner, Admin |
| Delete the workspace | `workspace.delete` | Owner only |
## Common questions
A workspace has one Owner. If you need a second person with near-total control,
make them an Admin – the only thing they cannot do is delete the workspace. To
hand over the business, transfer ownership. See
[change someone's role](/team/change-someones-role).
Not by default. Viewing other people's time needs `time.viewOthers`, which
Members do not hold. Give them a custom role if they need it.
Contractor is the narrower one. A Contractor tracks time and works tasks, but
cannot see your client list and cannot build reports. Use it for freelancers who
should not see your whole book of business. See
[manage contractors](/guides/manage-contractors).
Yes. Seats count everyone with access, including portal contacts and people who
have been invited but have not signed in yet. See [seats](/billing/seats).
Cost visibility is its own capability, `rate.viewCost`, separate from
`rate.viewBilling`. Someone can see what you charge without seeing what you pay.
Reports enforce the same split. See [cost rates](/rates/cost-rates).
## Related guides
Every capability against every role.
Which people and projects you can see.
Build a role that fits your team.
Switching whole areas on and off.