> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Location rules overview

> Require people to be on an office network or at a named place before they clock in, track time or submit. How location rules work and what they cannot see.

Location rules let you say **where** work can happen. A person covered by a rule
can only clock in, track time or submit from a network or a place you approved.

<Info>
  Location rules is a **Pro** feature and the app is **off by default**. Turn it on
  under **Settings → Apps**. See [Apps and modules](/concepts/apps-and-modules) and
  [Plans and features](/concepts/plans-and-features).
</Info>

## What a location rule is

A rule has three parts:

1. **What counts as being at work** – an office network, a named place, or both.
2. **What it limits** – the actions that need you to be at work.
3. **Who it applies to** – everyone, a role, a group, or one person.

Everything you do not limit carries on as normal, from anywhere.

## Location blocks a state, not a permission

This is the most important idea on the page.

A capability answers **"may you do this at all?"**. A location rule answers
**"can you do it right now, from here?"**.

|                 | Capability                      | Location rule                             |
| --------------- | ------------------------------- | ----------------------------------------- |
| What it decides | Whether you hold the permission | Whether your current location allows it   |
| Where it is set | Roles and per-person overrides  | A location policy                         |
| When it changes | When an admin changes your role | When you move                             |
| What you see    | The control disappears          | The control stays visible but is disabled |

Sarah Lin still holds `time.track` when she is at a coffee shop. The rule just
refuses the action until she is back on the office network. Nothing she has
already tracked is affected.

<Note>
  Blocked controls stay **visible and disabled**, with a message telling you where
  you *can* do it. They are never hidden. Hiding them would look like a permission
  problem, which it is not.
</Note>

## Two ways to check where someone is

| Check              | How it works                                                                      | Best on    |
| ------------------ | --------------------------------------------------------------------------------- | ---------- |
| **Office network** | Compares the address the person's connection comes from against ranges you listed | A computer |
| **Place**          | Compares the location the person's own device reports against a circle you drew   | A phone    |

A laptop often reports a location that is a long way out, because it works the
location out from nearby Wi-Fi rather than from GPS. Office networks are the
reliable check on a computer. Places work best on a phone.

Read [IP restrictions](/location-rules/ip-restrictions) and
[GPS restrictions](/location-rules/gps-restrictions) for each in full.

## Watching before enforcing

Every new rule starts as **Watching**.

| State         | What it does                                                     |
| ------------- | ---------------------------------------------------------------- |
| **Watching**  | Records who *would* have been stopped. Stops nobody.             |
| **Enforcing** | People the rule covers can only do the limited things from work. |

Run a rule in Watching for about a week, read
[Recent checks](/location-rules/activity-log), and only then switch it on. A rule
that looks correct on paper can still stop half your team on day one.

<Tip>
  Before you switch a rule to Enforcing, TimeTracker tells you how many people it
  covers **and** how many of them would have been stopped at least once in the last
  7 days. That number is the real test.
</Tip>

## Three outcomes, not two

A check never returns a simple yes or no. It returns one of three:

| Outcome                                   | Meaning                                         |
| ----------------------------------------- | ----------------------------------------------- |
| **At work**                               | The check passed                                |
| **Stopped** / **Would have been stopped** | The check ran and the person was away from work |
| **Couldn't check**                        | There was not enough information to decide      |

**"Couldn't check" never counts as a pass.** A rule that requires an office
network but has no networks listed returns "Couldn't check", not "At work". This
is why you cannot switch on an empty rule.

## What location rules can never limit

Settings, billing, roles and member management are **permanently excluded**. You
cannot build a rule that locks you or anyone else out of the admin screens.

That means a rule can never trap you. Even at your most restrictive, you can
always reach **Settings → Location rules** and switch it back to Watching.

## What it looks like

Go to **Settings → Location rules**. There are three sections:

| Section                      | What it holds                                                  |
| ---------------------------- | -------------------------------------------------------------- |
| **Rules**                    | Every rule, its state, what it limits, and what counts as work |
| **Who these rules apply to** | Which people, groups or roles each rule covers                 |
| **Who this affects**         | A live preview of exactly who is restricted today              |

A **Recent checks** link in the header opens the
[activity log](/location-rules/activity-log).

## Example

Northwind Studio has a hybrid team. Maya Ellis wants contractors to clock in from
the studio only, but wants staff to keep working from anywhere.

<Steps>
  <Step title="Turn the app on">
    **Settings → Apps → Location rules**. It is off by default.
  </Step>

  <Step title="Create the rule">
    Name it `Studio`. Set **Someone counts as here when they are** to
    **On an office network**. Add the studio's address range.
  </Step>

  <Step title="Limit only what matters">
    Tick **Clock in and out** and **Track time**. Leave everything else alone.
  </Step>

  <Step title="Point it at contractors">
    Under **Who these rules apply to**, apply `Studio` to the **Contractor**
    role. Ana Ferreira is now covered. Sarah Lin and Jonas Bergman are not.
  </Step>

  <Step title="Watch for a week">
    Leave it Watching. Read **Recent checks** each morning.
  </Step>

  <Step title="Switch it on">
    Open the rule and click **Start enforcing**.
  </Step>
</Steps>

## Options and settings

| Setting                      | Where                                        | Notes                           |
| ---------------------------- | -------------------------------------------- | ------------------------------- |
| Enforcement state            | Rule page → **Enforcement**                  | Watching or Enforcing           |
| What counts as being at work | Rule page → **The rule**                     | Network, place, both, or either |
| Office networks              | Rule page → **Office networks**              | Up to 50 address ranges         |
| Places                       | Rule page → **Places**                       | Up to 50 places                 |
| What the rule limits         | Rule page → **What this rule limits**        | 13 actions to choose from       |
| How often to check           | Rule page → **How often we check**           | 5, 15, 30 or 60 minutes         |
| Who it applies to            | Settings page → **Who these rules apply to** | Everyone, role, group or person |

## Permissions

| Action                        | Capability                        | Roles        |
| ----------------------------- | --------------------------------- | ------------ |
| See and change location rules | `location.manage`                 | Owner, Admin |
| Read the activity log         | `location.manage` or `audit.read` | Owner, Admin |

Project Manager, Finance, Member, Contractor and Client do **not** hold
`location.manage`. If you try without it you see: *"You can't change where people
are allowed to work from. Ask a workspace admin if you need to."*

Client-portal contacts are never subject to a location rule and never appear in
any count.

## What happens next

Once a rule is Enforcing, a covered person who is away from work sees a banner at
the top of the app and finds the limited controls disabled. Everything they have
already tracked stays saved. They can carry on with everything the rule does not
limit.

## Common questions

<AccordionGroup>
  <Accordion title="Does a location rule remove someone's permission?">
    No. It blocks an action based on where the person is right now. Their role and
    capabilities are untouched. Move back to an approved network or place and the
    action works again.
  </Accordion>

  <Accordion title="Can a rule lock me out of settings?">
    No. Settings, billing, roles, member management and location rules themselves
    are permanently excluded from what a rule can limit.
  </Accordion>

  <Accordion title="How do I lift every rule in a hurry?">
    Turn the Location rules app off under **Settings → Apps**. Every rule stops
    applying straight away. Your rules, the people they cover and the history are
    all kept.
  </Accordion>

  <Accordion title="Can someone fake their location?">
    A place comes from the person's own device and can be faked. TimeTracker flags
    obvious cases, but treat places as a nudge rather than proof. Office networks
    are much harder to work around.
  </Accordion>

  <Accordion title="Is this available on the Free plan?">
    No. Location rules is a Pro feature. See
    [Plans and features](/concepts/plans-and-features).
  </Accordion>

  <Accordion title="Does it work on the mobile app?">
    Yes. Checks from the mobile app are recorded the same way and are marked as
    coming from mobile in the activity log.
  </Accordion>
</AccordionGroup>

## Troubleshooting

**Everyone is being stopped.** Your rule almost certainly has an empty signal – a
network requirement with no ranges, or a place requirement with no places. That
returns "Couldn't check", which never passes. TimeTracker refuses to let you
switch such a rule on, so check whether the ranges were removed after you
enforced it.

**Nothing is ever stopped.** Check three things: the rule is Enforcing, an
assignment points at the people you meant, and the rule actually limits at least
one action.

**A rule applies to the wrong people.** The **Who this affects** table shows
exactly who is covered today. Precedence is person, then group, then role, then
everyone – the most specific wins.

## Related guides

<CardGroup cols={2}>
  <Card title="Create a policy" icon="plus" href="/location-rules/create-a-policy">
    Build a rule from scratch and assign it.
  </Card>

  <Card title="IP restrictions" icon="network-wired" href="/location-rules/ip-restrictions">
    Allow-list your office networks.
  </Card>

  <Card title="GPS restrictions" icon="map-pin" href="/location-rules/gps-restrictions">
    Draw a circle around a named place.
  </Card>

  <Card title="Activity log" icon="clock-rotate-left" href="/location-rules/activity-log">
    Read what each device reported.
  </Card>

  <Card title="Location permissions" icon="shield" href="/location-rules/location-permissions">
    Who can manage rules, and what people are asked for.
  </Card>

  <Card title="Apps and modules" icon="toggle-on" href="/concepts/apps-and-modules">
    Turn the Location rules app on.
  </Card>
</CardGroup>