> ## Documentation Index > Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt > Use this file to discover all available pages before exploring further. # Project permissions > Which roles can create, edit, archive and delete projects in TimeTracker, plus the separate capabilities that gate budgets, rates and cost figures. Projects use several capabilities, not one. Structure, money and rates are deliberately separate, because a project manager may run a project without seeing what it costs. ## The capabilities that matter | Capability | Covers | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | `project.manage` | Create, edit, archive, delete and restore a project. Members, sections, billing method, client, status, icon, key. | | `budget.manage` | See and set the project budget and its margin floor | | `rate.viewBilling` | See billing rates on the project roster | | `rate.viewCost` | See cost rates, and money-budget figures | | `time.viewCost` | Alternative route to cost visibility | | `rate.manage` | Edit a project rate override | | `task.create` / `task.edit` / `task.delete` | Work with the tasks inside a project | | `client.view` | Read the client behind a project | `project.manage` is the big one. Everything structural goes through it. ## Which roles hold them | Role | `project.manage` | `budget.manage` | `rate.viewBilling` | `rate.viewCost` | | ------------------- | ---------------- | --------------- | ------------------ | --------------- | | **Owner** | Yes | Yes | Yes | Yes | | **Admin** | Yes | Yes | Yes | Yes | | **Project Manager** | Yes | Yes | Yes | Varies | | **Finance** | No | Yes | Yes | Yes | | **Member** | No | No | No | No | | **Contractor** | No | No | No | No | | **Client** | No | No | No | No | These are the seeded defaults. Custom roles can mix them differently – see [/team/custom-roles](/team/custom-roles). Finance owns money, not delivery. Finance can set a budget and read rates, but cannot create or restructure a project. Project Manager is the mirror image. ## Capability is not scope Holding `project.manage` does not mean you can manage **every** project. | Question | Answered by | | ---------------------------------------- | ----------------------------- | | **May** you edit a project? | `project.manage` | | **Which** projects can you reach at all? | Your role's supervision scope | A project manager scoped to their own projects holds `project.manage`, but only over projects they manage or are staffed on. Both checks run on every action. See [/projects/project-visibility](/projects/project-visibility). ## What each capability unlocks on screen * You can open projects within your reach and work their tasks. * There is **no Actions menu** – no Archive, Delete or Restore. * The **Settings** tab's controls are unavailable to you. * Section three-dot menus and **Add section** do not work. * **New project** creates projects. * **Settings → General** edits identity, client, status, dates and tags. * **Settings → Group** adds and removes members. * **Settings → Finance** changes the billing method. * **Actions** offers Archive, Restore, Delete and Delete permanently. * Sections can be added, renamed, recategorised, reordered and deleted. * The **Budget** card appears in **Settings → Finance**. * You can set the budget type, amount, reset cadence and margin floor. * Without it the card is **hidden**, not disabled. * The **Cost** column appears on the project roster. * Forecast margin and Gross profit tiles appear on Overview. * A **money** budget shows real figures in the project list rather than "No budget set". * Without it, those numbers are never sent to your browser. ## Server-side enforcement Every capability is re-checked when the change is written, not just when the button is drawn. Hiding a control is a convenience; the refusal is what actually protects the data. That means: * A saved link into a project you cannot reach behaves like a project that does not exist. * A role change takes effect on your next action – no sign-out needed. * A control you never see is also a control the server would refuse. ## Cost visibility is not a plan question Who may **see** cost is a capability. What your plan gates is one write: setting a **cost rate** requires **Pro**. | | Gate | | --------------------------------- | ---------------------------------- | | May I see cost and margin? | `time.viewCost` or `rate.viewCost` | | May I set a cost rate? | Pro | | May I set a billing rate? | Free | | May I read cost already recorded? | Free, with the capability | See [/concepts/plans-and-features](/concepts/plans-and-features). ## App gating Projects live inside the **Projects & tasks** app. | State | Effect | | ---------------------------- | ------------------------------------------------------------------------------------- | | App **on** | Projects, Clients and Tasks all work | | App **off** | All three disappear from the sidebar and their URLs stop working. Nothing is deleted. | | Feature **not on your plan** | The area stays in the sidebar and shows a paywall | Several project surfaces depend on other apps too: | Surface | Needs | | --------------------------------------- | ------------------------------- | | Budget card and Overview financials | **Budgets & profitability** app | | Logging time against a project | **Time tracking** app | | Sharing a project with a portal contact | **Client portal** app | See [/concepts/apps-and-modules](/concepts/apps-and-modules). ## Example At Northwind Studio, on **Website Redesign**: | Person | Role | What they can do | | ------------- | --------------- | -------------------------------------------------------------------------------------------- | | Maya Ellis | Owner | Everything, including permanently deleting it | | Tom Whitfield | Admin | Everything except deleting the workspace | | Priya Raman | Project Manager | Edit settings, staff the team, set the budget, archive it – on her own projects only | | Daniel Okafor | Finance | Read the project, set the budget, read every rate. Cannot add a member or change the status. | | Sarah Lin | Member | Work tasks and log time. No Settings, no Actions, no rates. | | Ana Ferreira | Contractor | The same as Sarah, and cannot see clients or build reports | | Ruth Castillo | Client | Sees the project in the portal only, if it was ticked for her | ## Common questions Not by default. Add `project.manage` to a custom role if you want them to. Only with `rate.viewCost` or `time.viewCost`. The budget card and the cost column are separate gates on purpose. Because Finance owns the money surface, not delivery. If your finance lead also runs projects, build a custom role. Capabilities are set on the role, not per project. What is per project is **reach** – who is on the roster. Combine a narrow scope with project membership to get the same effect. Some capabilities can be denied per person. See [/team/per-person-permissions](/team/per-person-permissions). Being the manager grants **reach** to that project. It does not grant capabilities – those come from the role. ## Troubleshooting | Message or problem | Cause | Fix | | ---------------------------------------------------------- | ---------------------------------------------------- | --------------------------------- | | No **Actions** menu | You lack `project.manage` | Ask an admin | | No **Budget** card | You lack `budget.manage`, or the Budgets app is off | Check both | | No **Cost** column | You lack cost visibility | Ask an admin | | "We couldn't save these changes. You may lack permission…" | The server refused, or the key is taken | Check the key, then your role | | A project link says the project is gone | It is outside your reach, or was permanently deleted | Ask to be added to it | | **Projects** is missing from the sidebar | The app is off | Turn it on in **Settings → Apps** | | A control disappeared mid-session | Your role changed – capabilities are checked live | Reload the page | ## Related guides All seven roles, all 66 capabilities. The scope half of access. Build a role that fits. Deny a capability for one person. What switching an app off does. The same model, for clients.