> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate permissions

> Managing rates, seeing billable rates and seeing cost rates are three separate permissions. How the cost firewall works and which roles hold what.

Rates use three separate capabilities. Holding one does not give you the others.

| Capability         | What it allows       | Default roles                 |
| ------------------ | -------------------- | ----------------------------- |
| `rate.manage`      | Set and remove rates | Owner, Admin, Project Manager |
| `rate.viewBilling` | See billable rates   | Owner, Admin, Project Manager |
| `rate.viewCost`    | See cost rates       | **Owner, Admin only**         |

## Why they are separate

Each answers a different question:

* **`rate.manage`** – may you change what someone is charged at?
* **`rate.viewBilling`** – may you see what a client is charged?
* **`rate.viewCost`** – may you see what a colleague costs?

The third is the sensitive one. What someone costs is close to what they are paid, so it stays with the smallest possible group.

## Cost is a firewall, not a hidden column

Cost figures are removed **before** the page is built. Someone without `rate.viewCost` does not receive a cost number at all.

| Surface                           | Without `rate.viewCost`                                                      |
| --------------------------------- | ---------------------------------------------------------------------------- |
| **Settings** → **Rates** table    | The **Cost rate** column is not rendered                                     |
| The manage dialog                 | The **Cost (internal)** tab is not rendered                                  |
| **Rate history**                  | The cost table is absent, and no cost rows are sent                          |
| Project → **Settings** → **Team** | The **Cost** column is absent, header and cells                              |
| A resolved-rate lookup            | The cost field is not in the response                                        |
| The audit log                     | Rate amounts are never written to it, so the trail cannot leak a cost figure |

There is nothing hidden to inspect. The number never leaves the server.

## Roles at a glance

<Tabs>
  <Tab title="Owner">
    Everything. Sets and removes billing and cost rates, sees both, on every surface.
  </Tab>

  <Tab title="Admin">
    The same as Owner for rates. The only thing an Admin cannot do in the workspace is delete it.
  </Tab>

  <Tab title="Project Manager">
    Manages and sees **billing** rates. Cost is absent everywhere. Priya can price the work but cannot see what the team costs.
  </Tab>

  <Tab title="Finance">
    Holds **no** rate capability. Daniel cannot open the Rates page. He can still raise invoices from time that is already priced, and record payments.
  </Tab>

  <Tab title="Member / Contractor">
    No rate capability. Sarah and Ana cannot see rates, including their own, on the Rates page.
  </Tab>

  <Tab title="Client">
    No internal capabilities at all. A portal contact sees invoice totals for their own company, never a rate table.
  </Tab>
</Tabs>

## The Finance surprise

Finance is the role people get wrong. Daniel Okafor owns the money surface – he sends invoices and records payments – but he holds none of `rate.manage`, `rate.viewBilling` or `rate.viewCost`.

That works because pricing already happened. Every time entry carries the rate it was recorded at, so the invoice builder shows Daniel the billable value without ever showing him a rate table.

If your finance person also needs to set rates, add `rate.manage` and `rate.viewBilling` to a custom role. See [/concepts/roles-and-capabilities](/concepts/roles-and-capabilities).

## Capability is not scope

A capability says **whether** you may do something. It does not say **for whom**.

`rate.viewBilling` lets Priya see billable rates. Which people appear on the Rates roster is a separate question, answered by her supervision scope. Both have to pass.

## Related cost capabilities

Two other capabilities control cost visibility elsewhere:

| Capability      | Controls                                    | Default roles |
| --------------- | ------------------------------------------- | ------------- |
| `time.viewCost` | The cost figure on an individual time entry | Owner, Admin  |
| `rate.viewCost` | The cost rate itself                        | Owner, Admin  |

They are deliberately the same tier. Seeing every entry's cost would reveal the rate anyway.

## Plans and permissions are different questions

| Question                      | Answered by                                  |
| ----------------------------- | -------------------------------------------- |
| May I set a cost rate at all? | Your plan – `profitability` is a Pro feature |
| May **I** see a cost rate?    | Your capability – `rate.viewCost`            |

A Pro workspace still hides cost from a Project Manager. A Free workspace still shows cost to its Owner – it just cannot record a new cost rate.

See [/concepts/plans-and-features](/concepts/plans-and-features).

## Deleting a rate needs more than managing one

Removing a rate row is gated exactly like writing one, plus two extras for cost:

| Row kind | Requirements                                                                  |
| -------- | ----------------------------------------------------------------------------- |
| Billing  | `rate.manage`                                                                 |
| Cost     | `rate.manage` **and** `rate.viewCost` **and** the Pro `profitability` feature |

You cannot delete a figure you are not allowed to see.

## Common questions

<AccordionGroup>
  <Accordion title="Can I let a Project Manager see cost?">
    Yes, through a custom role that includes `rate.viewCost`. Think carefully first – it is close to sharing salary information.
  </Accordion>

  <Accordion title="Can someone see their own rate?">
    Not on the Rates page, which needs `rate.viewBilling`. A Member or Contractor has no route to it.
  </Accordion>

  <Accordion title="Why can Finance invoice without seeing rates?">
    Because the billable value is already stored on each time entry. The invoice builder shows money, not rates.
  </Accordion>

  <Accordion title="Does hiding cost hide margin too?">
    Yes. Margin is revenue minus cost, so a margin figure is a cost figure. It follows the same capability.
  </Accordion>

  <Accordion title="Can a capability be removed from one person only?">
    Some capabilities can be denied per person. Check the person's record before assuming a role grants something.
  </Accordion>

  <Accordion title="Who can change the workspace base currency?">
    That is `workspace.updateSettings`, not a rate capability. Owner and Admin hold it.
  </Accordion>
</AccordionGroup>

## Troubleshooting

| Symptom                                                                                      | Cause                                                          | Fix                               |
| -------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | --------------------------------- |
| **Rates** is missing from the settings sidebar                                               | You lack `rate.manage`                                         | Ask an Owner or Admin             |
| "You don't have access to manage rates in this workspace. Ask an owner or admin for access." | You reached the page without `rate.manage`                     | Ask for the capability            |
| "You don't have permission to see pay rates. Ask a workspace admin if you need access."      | You opened a person's Rates section without `rate.viewBilling` | Ask for the capability            |
| The **Cost (internal)** tab never appears                                                    | You lack `rate.viewCost`                                       | Ask an Owner or Admin             |
| The **Cost** column is missing from a project team table                                     | You lack `rate.viewCost`                                       | Ask an Owner or Admin             |
| A Pro prompt appears when saving a cost rate                                                 | The plan lacks `profitability`                                 | Upgrade the workspace             |
| Finance cannot open Rates                                                                    | Working as designed                                            | Use a custom role if they need it |

## Related guides

<CardGroup cols={2}>
  <Card title="Roles and capabilities" icon="shield-halved" href="/concepts/roles-and-capabilities">
    The full permission model.
  </Card>

  <Card title="Cost rates" icon="wallet" href="/rates/cost-rates">
    What the firewall protects.
  </Card>

  <Card title="Billable rates" icon="dollar-sign" href="/rates/billable-rates">
    The rate everyone with billing access sees.
  </Card>

  <Card title="Set a person rate" icon="user-pen" href="/rates/set-a-person-rate">
    Where these capabilities apply.
  </Card>

  <Card title="Invoice permissions" icon="file-shield" href="/invoicing/invoice-permissions">
    Who can invoice and take payment.
  </Card>

  <Card title="Plans and features" icon="badge-check" href="/concepts/plans-and-features">
    Plan gates versus permission gates.
  </Card>
</CardGroup>