Skip to main content
Two capabilities control the client portal: client.manage to invite and manage contacts, and project.manage to decide which projects each contact can open. The client role that portal contacts hold has zero capabilities. It is an empty set, not a small one.

​
The capabilities involved

​
Who holds them by default

Finance holds client.view but not client.manage, so a Finance user can open a client record without seeing the Portal access panel.
The Portal access panel is not greyed out for people who cannot use it. It is not rendered at all. If you cannot see it, you do not hold client.manage.

​
Why the client role holds nothing

Most permission systems give an external user a small set of read permissions. TimeTracker does not. A client role has an empty capability set. There is no read permission to grant and no internal screen that a portal contact could be given. What they see comes from a different mechanism entirely – a share between them and a project. This has three consequences worth knowing:
1

A client is sent to the portal, always

Signing in takes them to /northwind/portal. Every internal address refuses them.
2

A client cannot be promoted by accident

The role dropdown on the member record excludes Client, and the team invite dialog excludes it too. The only way to create one is a portal invite from a client record.
3

A client cannot own a workspace

The transfer-ownership card says so plainly: Client contacts can't own a workspace – they only see the portal.

​
The three gates a portal request passes

A portal screen only renders when all three are true.
The app switch and the plan work differently. Switching the app off blocks contacts from signing in at all. A plan without client_portal blocks the administration – you cannot invite a new contact or grant a new share – but it does not by itself sign an existing contact out. Switching the app off is what does that.

​
Sharing versus unsharing

These two are deliberately not symmetric: Sharing also refuses a target who is not a client-role member of the workspace. You cannot share a project with a colleague this way – project membership is a separate thing. Every share and unshare is written to your audit history.

​
Example

At Northwind Studio:
  • Maya Ellis (Owner) can do everything – invite Ruth, share projects, remove her, and switch the app off.
  • Tom Whitfield (Admin) can do the same, except deleting the workspace.
  • Priya Raman (Project Manager) can invite Ruth and tick or untick her projects, but cannot remove Ruth from the workspace or switch the app off.
  • Daniel Okafor (Finance) can open the Bluebird Coffee record and issue invoices Ruth will read, but sees no Portal access panel.
  • Sarah Lin (Member) can open client records but cannot touch portal access.
  • Ana Ferreira (Contractor) cannot see clients at all.

​
Capability is not scope

client.manage says you may manage client portal access. Supervision scope says which clients and projects you can reach in the first place. A Project Manager whose role is scoped to their own projects can only manage portal access for the clients they can already see. Both checks have to pass. See supervision scope.

​
Changing who can manage the portal

You can move these capabilities between roles, or build a custom role that holds exactly what you need.
1

Open Roles

Go to Settings → Roles. You need role.manage.
2

Edit or create a role

Click a role to edit it, or click New role.
3

Grant the capabilities

Under Clients, projects & tasks, tick Manage clients and Manage projects.
4

Set what the role can see

Choose an answer to What can this role see? so the role can actually reach the clients it manages.
5

Save

Click Save changes or Create role.
See custom roles.

​
Common questions

No. A portal contact sees the portal and nothing else. Reports are an internal surface.
They can revoke an outstanding invite and untick projects, but removing a membership needs member.remove, which Project Manager does not hold by default.
Yes. Create a role with Manage clients and Manage projects, and give it a supervision scope that reaches the right clients.
No capability is offered for a portal contact. Their access comes from project shares, not permissions.
You hold client.view but not client.manage. Ask an owner or admin.

​
Troubleshooting

Roles and capabilities

The full permission model.

Supervision scope

Which people and projects a role reaches.

Custom roles

Build a role from the capability list.

Invite a client contact

The invite flow.

What clients can see

The field-by-field list.

Client permissions

Managing clients generally.