> ## Documentation Index > Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt > Use this file to discover all available pages before exploring further. # Capabilities reference > All 66 TimeTracker capabilities explained in plain language – what each one lets a person do, which roles hold it, and which can be denied per person. A capability is one named permission, such as `time.approve`. Roles are bundles of capabilities. This page lists all 66, in the same groups you see in the role editor. For the grid view of who holds what, see the [roles and permissions matrix](/reference/roles-and-permissions-matrix). ## How to read the last column | You see | It means | | ----------------------- | --------------------------------------------------------- | | A list of roles | Those roles hold it by default | | **Owner only** | It can never be granted to any other role | | *(deniable per person)* | You can switch it off for one person on top of their role | | Everyone except Client | All six internal roles hold it | **A capability is not a scope.** `time.viewOthers` says you *may* view other people's time. Your [supervision scope](/concepts/supervision-scope) says *whose*. Both have to pass. ## The 66 capabilities ### Workspace | Key | Name | What it lets you do | Held by default | | -------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------- | | `workspace.updateSettings` | Edit workspace settings | Change the workspace name, working hours, date and time formats, and time rules. Everyone in the workspace feels these changes. | Owner, Admin | | `workspace.delete` | Delete the workspace | Permanently delete the whole workspace and everything in it. This cannot be undone. | **Owner only** | | `billing.manage` | Manage plan & billing | Change the plan, update the card, or cancel the subscription. Cancelling affects the whole workspace. | Owner, Admin | | `data.export` | Export workspace data | Download a copy of everything in the workspace, including time, money, and client records. | Owner, Admin, Finance | | `location.manage` | Manage location rules | Set the office networks and places people must be in to clock in, track time, or submit timesheets – and decide who each rule applies to. This can stop teammates working from home. | Owner, Admin | ### Members and roles | Key | Name | What it lets you do | Held by default | | ------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | | `member.invite` | Invite members | Send an email invite so a new person can join the workspace. | Owner, Admin, Project Manager | | `member.create` | Add members directly | Add someone to the group yourself – their name, role, pay rates and groups – instead of waiting for them to accept an invite. They can be added without an email, in which case they appear in reports and can have time logged for them, but cannot sign in. | Owner, Admin | | `member.changeRole` | Change member roles | Move a person to a different role, which changes what they are allowed to do. | Owner, Admin | | `member.remove` | Remove members | Take a person out of the workspace. Their tracked time stays. | Owner, Admin | | `role.manage` | Manage roles & permissions | Create roles, rename them, delete them, and choose what each one can do. This includes handing out permissions they do not have themselves. | Owner, Admin | | `invite.revoke` | Revoke pending invites | Cancel an invite that was sent but not accepted yet. | Owner, Admin, Project Manager | | `audit.read` | Read the audit log | See a history of who changed what, and when. | Owner, Admin, Project Manager, Finance | | `group.manage` | Manage groups | Create groups, rename them, delete them, and choose who is on each one. | Owner, Admin | ### Clients, projects and tasks | Key | Name | What it lets you do | Held by default | | --------------------- | --------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | | `client.view` | View clients | See the client list and each client's details. Anyone who can manage clients can already do this. | Owner, Admin, Project Manager, Finance, Member | | `client.manage` | Manage clients | Add new clients, edit their details, and archive ones you no longer work with. | Owner, Admin, Project Manager | | `project.manage` | Manage projects | Create projects, edit their settings, and choose who works on them. | Owner, Admin, Project Manager | | `tag.manage` | Manage tags | Add tags, rename them, change their colour, and delete them. Deleting a tag removes it from every task using it. | Owner, Admin, Project Manager | | `task.create` | Create tasks | Add new tasks to a project. | Owner, Admin, Project Manager, Member, Contractor | | `task.edit` | Edit tasks | Change a task's title, description, assignee, dates, and status. | Owner, Admin, Project Manager, Member, Contractor | | `task.delete` | Delete tasks | Move a task to the trash. Time already tracked against it is kept. | Owner, Admin, Project Manager | | `task.reviseEstimate` | Revise task estimates | Set how many hours a task should take, or change that number later. Every change is recorded. | Owner, Admin, Project Manager | | `task.bulkEdit` | Bulk-edit tasks | Change many tasks at once, such as moving or reassigning a whole group. | Owner, Admin, Project Manager | ### Rates and cost | Key | Name | What it lets you do | Held by default | | ------------------ | ------------------ | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | `rate.manage` | Manage rates | Set what people are billed out at and what they cost the business. | Owner, Admin, Project Manager | | `rate.viewBilling` | View billing rates | See the hourly rates you charge clients. | Owner, Admin, Project Manager | | `rate.viewCost` | View cost rates | See what each person costs the business per hour. This is private pay information, so give it out carefully. | Owner, Admin | ### Time tracking | Key | Name | What it lets you do | Held by default | | --------------- | -------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------- | | `time.track` | Track time | Run a timer and add time by hand on their own timesheet. | Owner, Admin, Project Manager, Member, Contractor | | `time.edit` | Edit time entries | Change or delete their own time, as long as the week is not locked yet. | Owner, Admin, Project Manager, Member, Contractor | | `time.viewCost` | View time entry cost | See what each block of tracked time cost the business. This reveals pay information. | Owner, Admin | ### Timesheets | Key | Name | What it lets you do | Held by default | | --------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | | `time.submit` | Submit own timesheet | Send their own timesheet off for approval. | Owner, Admin, Project Manager, Member, Contractor | | `time.viewOthers` | View others' timesheets | Open a teammate's timesheet and see the time they logged. | Owner, Admin, Project Manager | | `time.editOthers` | Edit others' time entries | Add, change, or delete time on someone else's timesheet. | Owner, Admin, Project Manager | | `time.submitOnBehalf` | Submit timesheets on behalf of others | Send a teammate's timesheet for approval when they have not done it themselves. | Owner, Admin, Project Manager | | `time.remind` | Send timesheet reminders | Send a reminder to people who have not turned in their timesheet yet. | Owner, Admin, Project Manager | | `time.approve` | Approve or reject timesheets | Accept a submitted timesheet, which locks it, or send it back for changes. | Owner, Admin, Project Manager | | `time.reopenApproval` | Reopen an approved timesheet | Undo an approval so the time can be fixed and sent again. | Owner, Admin | | `time.adjust` | Post time adjustments | Add or subtract hours on a timesheet that is already locked, without unlocking it. The original entries stay as they were. | Owner, Admin, Project Manager, Finance | | `period.close` | Close time periods | Lock every timesheet up to a date you pick, so no one can change that time again. This cannot be undone. | Owner, Admin | ### Time Clock | Key | Name | What it lets you do | Held by default | | ------------------------- | ------------------------------------ | ----------------------------------------------------------------------------------- | ---------------------------------------------- | | `timecard.clock` | Clock in and out | Start and end their own shifts. | Everyone except Client *(deniable per person)* | | `timecard.view` | View own timecard | See the shifts they clocked and how those compare to the hours they were scheduled. | Everyone except Client | | `timecard.submit` | Submit own timecard | Send their own timecard off for approval. | Everyone except Client | | `timecard.manage` | Edit others' timecards | Open a teammate's timecard and fix or add shifts on it. | Owner, Admin, Project Manager | | `timecard.submitOnBehalf` | Submit timecards on behalf of others | Send a teammate's timecard for approval when they have not done it themselves. | Owner, Admin, Project Manager | | `timecard.approve` | Approve or reject timecards | Accept a submitted timecard or send it back, and decide on requests to fix a shift. | Owner, Admin, Project Manager | | `timecard.reopen` | Reopen an approved timecard | Undo an approval so the shifts can be fixed and sent again. | Owner, Admin | ### Work schedules | Key | Name | What it lets you do | Held by default | | ----------------- | ---------------- | ----------------------------------------------------------------------------------------------------- | ---------------------- | | `schedule.view` | View schedules | See the hours people are expected to work. Which teammates they can see depends on the setting above. | Everyone except Client | | `schedule.manage` | Manage schedules | Set up working patterns, assign them to people, and add one-off changes like a half day. | Owner, Admin | ### Budgets and money | Key | Name | What it lets you do | Held by default | | ------------------------ | -------------------------- | -------------------------------------------------------------------------------------- | -------------------------------------- | | `budget.manage` | Manage project budgets | Set how much money or how many hours a project has to spend, and change it later. | Owner, Admin, Project Manager | | `invoice.manage` | Manage invoices | Create invoices, send them to clients, and cancel ones sent by mistake. | Owner, Admin, Project Manager, Finance | | `payment.record` | Record payments | Mark an invoice as paid, issue a credit note, or write off money you will not collect. | Owner, Admin, Project Manager, Finance | | `expense.submit` | Submit expenses | Claim money they spent on a project, such as travel or software. | Everyone except Client | | `expense.approve` | Approve or reject expenses | Decide whether a claimed expense gets paid and billed on. | Owner, Admin, Project Manager, Finance | | `expenseCategory.manage` | Manage expense categories | Choose the list of expense types people pick from, such as Travel or Meals. | Owner, Admin, Finance | ### Time off | Key | Name | What it lets you do | Held by default | | -------------------- | ----------------------- | ------------------------------------------------------------------------------------------------ | ----------------------------- | | `leave.request` | Request leave | Ask for time off, such as holiday or sick days. | Everyone except Client | | `leave.approve` | Approve or reject leave | Say yes or no to a teammate's time off request. | Owner, Admin, Project Manager | | `leave.viewOthers` | View others' leave | See when teammates are away and how much time off they have left. | Owner, Admin, Project Manager | | `leave.managePolicy` | Manage leave policies | Decide how much time off people get, set public holidays, and correct someone's balance by hand. | Owner, Admin | ### Reports | Key | Name | What it lets you do | Held by default | | ----------------- | ---------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------- | | `report.view` | View reports | Open reports and read the numbers in them. | Owner, Admin, Project Manager, Member | | `report.create` | Create reports | Build a new report and save it. | Owner, Admin, Project Manager, Member | | `report.edit` | Edit own reports | Change or archive reports they built themselves. Changing someone else's shared report needs Manage reports. | Owner, Admin, Project Manager, Member | | `report.manage` | Manage reports | Change or delete any saved report, including ones other people built. | Owner, Admin | | `report.share` | Share reports | Publish a report so everyone in the workspace can open it. | Owner, Admin | | `report.schedule` | Schedule reports | Have a report emailed out on a regular basis, such as every Monday. | Owner, Admin | | `report.export` | Export reports | Download the report's rows as a file to open in a spreadsheet. | Owner, Admin | ### Resource Planner | Key | Name | What it lets you do | Held by default | | -------------------- | --------------------------- | -------------------------------------------------------- | ------------------------------------------------- | | `block.manage` | Manage own planned work | Create, move and delete planner blocks for yourself. | Owner, Admin, Project Manager, Member, Contractor | | `block.manageOthers` | Manage others' planned work | Create, move and delete planner blocks for other people. | Owner, Admin, Project Manager | ### Integrations | Key | Name | What it lets you do | Held by default | | ---------------- | --------------- | -------------------------------------------------------------------------------------------- | --------------- | | `webhook.manage` | Manage webhooks | Add, edit and remove webhook endpoints, rotate their signing secrets, and resend a delivery. | Owner, Admin | ## The four that are not in the role editor Four capabilities exist in the permission model but are not offered as checkboxes when you edit a role: | Capability | Why | | -------------------- | --------------------------------------------- | | `workspace.delete` | Owner-exclusive. Deliberately never editable. | | `block.manage` | Not yet toggleable in the role editor. | | `block.manageOthers` | Not yet toggleable in the role editor. | | `webhook.manage` | Not yet toggleable in the role editor. | They still apply everywhere else – the matrix above is what the product enforces. ## Capabilities that only make sense with a scope Fifteen capabilities reach across people. Granting one at supervision scope **None** gives someone a permission with nobody to use it on. The role editor warns you when that combination is set. `time.viewOthers` · `time.editOthers` · `time.submitOnBehalf` · `time.reopenApproval` · `time.remind` · `time.approve` · `time.adjust` · `timecard.manage` · `timecard.approve` · `timecard.submitOnBehalf` · `timecard.reopen` · `leave.approve` · `leave.viewOthers` · `expense.approve` · `block.manageOthers` ## The three money-visibility capabilities These decide which **numbers** a person sees, not which **records**. They are the most sensitive grants in the product, because two of them expose pay information. | Capability | What it reveals | | ------------------ | ---------------------------------------------- | | `rate.viewBilling` | The hourly rates you charge clients | | `rate.viewCost` | What each person costs the business per hour | | `time.viewCost` | What a block of tracked time cost the business | Reports enforce the same split. A report column that needs cost is dropped for a person who lacks the capability, and margin needs **both** cost and billing. See [cost rates](/rates/cost-rates). ## Common questions No. The 66 are fixed. A [custom role](/team/custom-roles) combines existing capabilities in a new way – it cannot create a new kind of permission. `report.edit` covers reports the person built themselves. `report.manage` covers any saved report in the workspace, including other people's. `client.view` reads the client list and each client's details. `client.manage` adds, edits and archives them. Anyone who can manage can already view. They are different records. A timesheet is billable project time. A timecard is presence at work. Each has its own approval chain, so each has its own capabilities rather than riding on the other's. No. `time.edit` covers your own time. Changing a teammate's entry needs `time.editOthers`, and that person has to be in your scope. ## Related guides Every capability against every role. How roles and capabilities fit together. Pick capabilities and build your own role. Switch one capability off for one person. Who a capability applies to. What each refusal message means.