Skip to main content
Two different questions live on this page:
  1. Who can manage location rules – a capability question.
  2. What a rule can do to someone – a state question, and a deliberately limited one.

​
Who can manage location rules

One capability controls everything: location.manage. Only Owner and Admin. It is not given to Project Manager or Finance, and it is not granted to custom roles by default. Without it you see: “You can’t change where people are allowed to work from. Ask a workspace admin if you need to.”

​
What the capability covers

An auditor holding audit.read can read the log without being able to change a single rule.
The Location rules sidebar entry appears only when you hold the capability and the app is switched on.

​
Location is a state block, not a permission

This is the distinction that matters most. Sarah Lin still holds time.track in a coffee shop. The rule refuses the action until she is back at an approved network or place. Her role is untouched, and everything she already tracked is safe.
Blocked controls are visible and disabled, never hidden. Hiding them would look like a permission problem, which would send people to the wrong person for help.

​
What a rule can never limit

Thirteen actions can be limited. Everything to do with running the workspace is permanently excluded: The enforce confirmation states it: “you will always be able to reach these settings – location rules never limit settings, billing or roles.”

​
The 13 actions a rule can limit

A rule can only ever restrict a capability someone already holds. It never grants anything.

​
What people are asked on their own device

Being straight with your team about this is worth doing before you switch a rule on.

​
For an office network check

Nothing is asked. The address a connection comes from is visible to any website. There is no prompt and nothing to allow.

​
For a place check

TimeTracker never triggers a browser permission prompt on its own. If somebody has not granted location access, every check on their actions records Couldn’t check, and they see a banner explaining how to allow it if a rule needs it.

​
What is stored about a person

For each check: the time, the internet address, the position their device reported, the rule that applied, and the outcome. The reported position is kept even when it was discarded as too vague. That record is readable by anyone with location.manage or audit.read. See Activity log.

​
Who is never subject to a rule

​
What someone blocked actually sees

A banner at the top of the app, with a Check again button: Blocked controls show a message naming where the action can be done – “You can clock in from work. Nothing you’ve tracked is affected.”
Every message says the same thing twice: what to do, and that nothing is lost. That is deliberate. A person blocked mid-week needs to know their tracked time is safe before they need to know anything else.

​
Precedence when several assignments match

Most specific wins: Person → Group → Role → Everyone Within the same level, an exemption beats a restriction. Across levels the more specific level wins outright, so a rule applied to one person survives a workspace-wide exemption. Someone in several groups follows their first group.

​
Example

Northwind Studio’s setup: Sarah’s person-level exemption beats the workspace-wide Studio assignment, because a more specific level always wins.

​
Turning everything off

Turn the Location rules app off under Settings → Apps: “Location rules stop applying straight away and everyone can clock in and submit from anywhere. Your rules, the people they cover, and the history are all kept.” This is the emergency exit. An Owner or Admin who has locked the team out can always reach it, because settings can never be limited by a rule.
Even with the app off, an admin can still open the rules pages to see and fix them. That is deliberate – you must be able to repair a rule before you turn the app back on.

​
Common questions

No. Settings, billing, roles and member management can never be limited. You can always reach Settings → Location rules and switch a rule back to Watching, or turn the whole app off.
No. Only Owner and Admin hold location.manage.
No. It blocks an action based on where you are. Your role and capabilities are unchanged, and the action works again as soon as you are back at work.
Not from TimeTracker. It never triggers a permission prompt on its own. Someone who has not granted location produces “Couldn’t check” and sees a banner explaining how to allow it.
The internet address you connected from, the position your device reported, which rule applied and what was decided. All of it is in the activity log.
No. Clients are never subject to a location rule.
Yes. Apply a rule to that person and choose Exempt – no location rule. A person-level assignment beats a workspace-level one.

​
Troubleshooting

I cannot see the Location rules page. You need location.manage, and the Location rules app must be on. Owner and Admin only. Someone is blocked who should not be. Check the Who this affects table on the settings page. It shows the rule and the level it was applied at. Then check the activity log for the reason. A rule is stopping an action I did not intend to limit. Open the rule and read What this rule limits. Untick what should not be there and save. I need to lift everything now. Turn the Location rules app off under Settings → Apps. Every rule stops applying immediately and nothing is lost.

Location rules overview

The concept and what it cannot see.

Create a location rule

Building and assigning a rule.

Activity log

What is recorded about each check.

Roles and capabilities

The full capability model.

Per-person permissions

Denying a capability, which is a different thing.

Apps and modules

The emergency off switch.