Capabilities reference

A capability is one named permission, such as time.approve. Roles are bundles of capabilities. This page lists all 66, in the same groups you see in the role editor. For the grid view of who holds what, see the roles and permissions matrix.

How to read the last column

You see	It means
A list of roles	Those roles hold it by default
Owner only	It can never be granted to any other role
(deniable per person)	You can switch it off for one person on top of their role
Everyone except Client	All six internal roles hold it

A capability is not a scope. time.viewOthers says you may view other people’s time. Your supervision scope says whose. Both have to pass.

The 66 capabilities

Workspace

Key	Name	What it lets you do	Held by default
`workspace.updateSettings`	Edit workspace settings	Change the workspace name, working hours, date and time formats, and time rules. Everyone in the workspace feels these changes.	Owner, Admin
`workspace.delete`	Delete the workspace	Permanently delete the whole workspace and everything in it. This cannot be undone.	Owner only
`billing.manage`	Manage plan & billing	Change the plan, update the card, or cancel the subscription. Cancelling affects the whole workspace.	Owner, Admin
`data.export`	Export workspace data	Download a copy of everything in the workspace, including time, money, and client records.	Owner, Admin, Finance
`location.manage`	Manage location rules	Set the office networks and places people must be in to clock in, track time, or submit timesheets – and decide who each rule applies to. This can stop teammates working from home.	Owner, Admin

Members and roles

Key	Name	What it lets you do	Held by default
`member.invite`	Invite members	Send an email invite so a new person can join the workspace.	Owner, Admin, Project Manager
`member.create`	Add members directly	Add someone to the group yourself – their name, role, pay rates and groups – instead of waiting for them to accept an invite. They can be added without an email, in which case they appear in reports and can have time logged for them, but cannot sign in.	Owner, Admin
`member.changeRole`	Change member roles	Move a person to a different role, which changes what they are allowed to do.	Owner, Admin
`member.remove`	Remove members	Take a person out of the workspace. Their tracked time stays.	Owner, Admin
`role.manage`	Manage roles & permissions	Create roles, rename them, delete them, and choose what each one can do. This includes handing out permissions they do not have themselves.	Owner, Admin
`invite.revoke`	Revoke pending invites	Cancel an invite that was sent but not accepted yet.	Owner, Admin, Project Manager
`audit.read`	Read the audit log	See a history of who changed what, and when.	Owner, Admin, Project Manager, Finance
`group.manage`	Manage groups	Create groups, rename them, delete them, and choose who is on each one.	Owner, Admin

Clients, projects and tasks

Key	Name	What it lets you do	Held by default
`client.view`	View clients	See the client list and each client’s details. Anyone who can manage clients can already do this.	Owner, Admin, Project Manager, Finance, Member
`client.manage`	Manage clients	Add new clients, edit their details, and archive ones you no longer work with.	Owner, Admin, Project Manager
`project.manage`	Manage projects	Create projects, edit their settings, and choose who works on them.	Owner, Admin, Project Manager
`tag.manage`	Manage tags	Add tags, rename them, change their colour, and delete them. Deleting a tag removes it from every task using it.	Owner, Admin, Project Manager
`task.create`	Create tasks	Add new tasks to a project.	Owner, Admin, Project Manager, Member, Contractor
`task.edit`	Edit tasks	Change a task’s title, description, assignee, dates, and status.	Owner, Admin, Project Manager, Member, Contractor
`task.delete`	Delete tasks	Move a task to the trash. Time already tracked against it is kept.	Owner, Admin, Project Manager
`task.reviseEstimate`	Revise task estimates	Set how many hours a task should take, or change that number later. Every change is recorded.	Owner, Admin, Project Manager
`task.bulkEdit`	Bulk-edit tasks	Change many tasks at once, such as moving or reassigning a whole group.	Owner, Admin, Project Manager

Rates and cost

Key	Name	What it lets you do	Held by default
`rate.manage`	Manage rates	Set what people are billed out at and what they cost the business.	Owner, Admin, Project Manager
`rate.viewBilling`	View billing rates	See the hourly rates you charge clients.	Owner, Admin, Project Manager
`rate.viewCost`	View cost rates	See what each person costs the business per hour. This is private pay information, so give it out carefully.	Owner, Admin

Time tracking

Key	Name	What it lets you do	Held by default
`time.track`	Track time	Run a timer and add time by hand on their own timesheet.	Owner, Admin, Project Manager, Member, Contractor
`time.edit`	Edit time entries	Change or delete their own time, as long as the week is not locked yet.	Owner, Admin, Project Manager, Member, Contractor
`time.viewCost`	View time entry cost	See what each block of tracked time cost the business. This reveals pay information.	Owner, Admin

Timesheets

Key	Name	What it lets you do	Held by default
`time.submit`	Submit own timesheet	Send their own timesheet off for approval.	Owner, Admin, Project Manager, Member, Contractor
`time.viewOthers`	View others’ timesheets	Open a teammate’s timesheet and see the time they logged.	Owner, Admin, Project Manager
`time.editOthers`	Edit others’ time entries	Add, change, or delete time on someone else’s timesheet.	Owner, Admin, Project Manager
`time.submitOnBehalf`	Submit timesheets on behalf of others	Send a teammate’s timesheet for approval when they have not done it themselves.	Owner, Admin, Project Manager
`time.remind`	Send timesheet reminders	Send a reminder to people who have not turned in their timesheet yet.	Owner, Admin, Project Manager
`time.approve`	Approve or reject timesheets	Accept a submitted timesheet, which locks it, or send it back for changes.	Owner, Admin, Project Manager
`time.reopenApproval`	Reopen an approved timesheet	Undo an approval so the time can be fixed and sent again.	Owner, Admin
`time.adjust`	Post time adjustments	Add or subtract hours on a timesheet that is already locked, without unlocking it. The original entries stay as they were.	Owner, Admin, Project Manager, Finance
`period.close`	Close time periods	Lock every timesheet up to a date you pick, so no one can change that time again. This cannot be undone.	Owner, Admin

Time Clock

Key	Name	What it lets you do	Held by default
`timecard.clock`	Clock in and out	Start and end their own shifts.	Everyone except Client (deniable per person)
`timecard.view`	View own timecard	See the shifts they clocked and how those compare to the hours they were scheduled.	Everyone except Client
`timecard.submit`	Submit own timecard	Send their own timecard off for approval.	Everyone except Client
`timecard.manage`	Edit others’ timecards	Open a teammate’s timecard and fix or add shifts on it.	Owner, Admin, Project Manager
`timecard.submitOnBehalf`	Submit timecards on behalf of others	Send a teammate’s timecard for approval when they have not done it themselves.	Owner, Admin, Project Manager
`timecard.approve`	Approve or reject timecards	Accept a submitted timecard or send it back, and decide on requests to fix a shift.	Owner, Admin, Project Manager
`timecard.reopen`	Reopen an approved timecard	Undo an approval so the shifts can be fixed and sent again.	Owner, Admin

Work schedules

Key	Name	What it lets you do	Held by default
`schedule.view`	View schedules	See the hours people are expected to work. Which teammates they can see depends on the setting above.	Everyone except Client
`schedule.manage`	Manage schedules	Set up working patterns, assign them to people, and add one-off changes like a half day.	Owner, Admin

Budgets and money

Key	Name	What it lets you do	Held by default
`budget.manage`	Manage project budgets	Set how much money or how many hours a project has to spend, and change it later.	Owner, Admin, Project Manager
`invoice.manage`	Manage invoices	Create invoices, send them to clients, and cancel ones sent by mistake.	Owner, Admin, Project Manager, Finance
`payment.record`	Record payments	Mark an invoice as paid, issue a credit note, or write off money you will not collect.	Owner, Admin, Project Manager, Finance
`expense.submit`	Submit expenses	Claim money they spent on a project, such as travel or software.	Everyone except Client
`expense.approve`	Approve or reject expenses	Decide whether a claimed expense gets paid and billed on.	Owner, Admin, Project Manager, Finance
`expenseCategory.manage`	Manage expense categories	Choose the list of expense types people pick from, such as Travel or Meals.	Owner, Admin, Finance

Time off

Key	Name	What it lets you do	Held by default
`leave.request`	Request leave	Ask for time off, such as holiday or sick days.	Everyone except Client
`leave.approve`	Approve or reject leave	Say yes or no to a teammate’s time off request.	Owner, Admin, Project Manager
`leave.viewOthers`	View others’ leave	See when teammates are away and how much time off they have left.	Owner, Admin, Project Manager
`leave.managePolicy`	Manage leave policies	Decide how much time off people get, set public holidays, and correct someone’s balance by hand.	Owner, Admin

Reports

Key	Name	What it lets you do	Held by default
`report.view`	View reports	Open reports and read the numbers in them.	Owner, Admin, Project Manager, Member
`report.create`	Create reports	Build a new report and save it.	Owner, Admin, Project Manager, Member
`report.edit`	Edit own reports	Change or archive reports they built themselves. Changing someone else’s shared report needs Manage reports.	Owner, Admin, Project Manager, Member
`report.manage`	Manage reports	Change or delete any saved report, including ones other people built.	Owner, Admin
`report.share`	Share reports	Publish a report so everyone in the workspace can open it.	Owner, Admin
`report.schedule`	Schedule reports	Have a report emailed out on a regular basis, such as every Monday.	Owner, Admin
`report.export`	Export reports	Download the report’s rows as a file to open in a spreadsheet.	Owner, Admin

Resource Planner

Key	Name	What it lets you do	Held by default
`block.manage`	Manage own planned work	Create, move and delete planner blocks for yourself.	Owner, Admin, Project Manager, Member, Contractor
`block.manageOthers`	Manage others’ planned work	Create, move and delete planner blocks for other people.	Owner, Admin, Project Manager

Integrations

Key	Name	What it lets you do	Held by default
`webhook.manage`	Manage webhooks	Add, edit and remove webhook endpoints, rotate their signing secrets, and resend a delivery.	Owner, Admin

The four that are not in the role editor

Four capabilities exist in the permission model but are not offered as checkboxes when you edit a role:

Capability	Why
`workspace.delete`	Owner-exclusive. Deliberately never editable.
`block.manage`	Not yet toggleable in the role editor.
`block.manageOthers`	Not yet toggleable in the role editor.
`webhook.manage`	Not yet toggleable in the role editor.

They still apply everywhere else – the matrix above is what the product enforces.

Capabilities that only make sense with a scope

Fifteen capabilities reach across people. Granting one at supervision scope None gives someone a permission with nobody to use it on. The role editor warns you when that combination is set. time.viewOthers · time.editOthers · time.submitOnBehalf · time.reopenApproval · time.remind · time.approve · time.adjust · timecard.manage · timecard.approve · timecard.submitOnBehalf · timecard.reopen · leave.approve · leave.viewOthers · expense.approve · block.manageOthers

The three money-visibility capabilities

These decide which numbers a person sees, not which records. They are the most sensitive grants in the product, because two of them expose pay information.

Capability	What it reveals
`rate.viewBilling`	The hourly rates you charge clients
`rate.viewCost`	What each person costs the business per hour
`time.viewCost`	What a block of tracked time cost the business

Reports enforce the same split. A report column that needs cost is dropped for a person who lacks the capability, and margin needs both cost and billing. See cost rates.

Common questions

Can I invent a new capability?

No. The 66 are fixed. A custom role combines existing capabilities in a new way – it cannot create a new kind of permission.

What is the difference between report.edit and report.manage?

report.edit covers reports the person built themselves. report.manage covers any saved report in the workspace, including other people’s.

What is the difference between client.view and client.manage?

client.view reads the client list and each client’s details. client.manage adds, edits and archives them. Anyone who can manage can already view.

Why are Timecards separate from Timesheets?

They are different records. A timesheet is billable project time. A timecard is presence at work. Each has its own approval chain, so each has its own capabilities rather than riding on the other’s.

Does time.edit let me change someone else's entry?

No. time.edit covers your own time. Changing a teammate’s entry needs time.editOthers, and that person has to be in your scope.

Permissions matrix

Every capability against every role.

Roles and permissions

How roles and capabilities fit together.

Custom roles

Pick capabilities and build your own role.

Per-person permissions

Switch one capability off for one person.

Supervision scope

Who a capability applies to.

Access errors

What each refusal message means.

Reference

Help

Capabilities reference

How to read the last column

The 66 capabilities

Workspace

Members and roles

Clients, projects and tasks

Rates and cost

Time tracking

Timesheets

Time Clock

Work schedules

Budgets and money

Time off

Reports

Resource Planner

Integrations

The four that are not in the role editor

Capabilities that only make sense with a scope

The three money-visibility capabilities

Common questions

Permissions matrix

Roles and permissions

Custom roles

Per-person permissions

Supervision scope

Access errors

​How to read the last column

​The 66 capabilities

​Workspace

​Members and roles

​Clients, projects and tasks

​Rates and cost

​Time tracking

​Timesheets

​Time Clock

​Work schedules

​Budgets and money

​Time off

​Reports

​Resource Planner

​Integrations

​The four that are not in the role editor

​Capabilities that only make sense with a scope

​The three money-visibility capabilities

​Common questions

​Related guides

Permissions matrix

Roles and permissions

Custom roles

Per-person permissions

Supervision scope

Access errors

How to read the last column

The 66 capabilities

Workspace

Members and roles

Clients, projects and tasks

Rates and cost

Time tracking

Timesheets

Time Clock

Work schedules

Budgets and money

Time off

Reports

Resource Planner

Integrations

The four that are not in the role editor

Capabilities that only make sense with a scope

The three money-visibility capabilities

Common questions

Related guides