Roles and permissions matrix

Every capability in TimeTracker, against every role. A check means the role holds it by default. A dash means it does not.

Role summary

Role	Capabilities	Default supervision scope
Owner	66 of 66	Workspace (locked)
Admin	65 of 66	Workspace
Project Manager	43 of 66	Project
Finance	14 of 66	Workspace
Member	16 of 66	None
Contractor	12 of 66	None
Client	0 of 66	None (locked)

Owner and Admin differ by exactly one capability: workspace.delete. Everything else an Owner can do, an Admin can do too.Client holds zero internal capabilities. A portal contact is not a member of your team. They see only what is shared with their own client company. That empty set is the portal firewall, and it cannot be edited.

The matrix

Workspace

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`workspace.updateSettings`	✓	✓	–	–	–	–	–
`workspace.delete`	✓	–	–	–	–	–	–
`billing.manage`	✓	✓	–	–	–	–	–
`data.export`	✓	✓	–	✓	–	–	–
`location.manage`	✓	✓	–	–	–	–	–

Members and roles

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`member.invite`	✓	✓	✓	–	–	–	–
`member.create`	✓	✓	–	–	–	–	–
`member.changeRole`	✓	✓	–	–	–	–	–
`member.remove`	✓	✓	–	–	–	–	–
`role.manage`	✓	✓	–	–	–	–	–
`invite.revoke`	✓	✓	✓	–	–	–	–
`audit.read`	✓	✓	✓	✓	–	–	–
`group.manage`	✓	✓	–	–	–	–	–

Clients, projects and tasks

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`client.view`	✓	✓	✓	✓	✓	–	–
`client.manage`	✓	✓	✓	–	–	–	–
`project.manage`	✓	✓	✓	–	–	–	–
`tag.manage`	✓	✓	✓	–	–	–	–
`task.create`	✓	✓	✓	–	✓	✓	–
`task.edit`	✓	✓	✓	–	✓	✓	–
`task.delete`	✓	✓	✓	–	–	–	–
`task.reviseEstimate`	✓	✓	✓	–	–	–	–
`task.bulkEdit`	✓	✓	✓	–	–	–	–

Rates and cost

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`rate.manage`	✓	✓	✓	–	–	–	–
`rate.viewBilling`	✓	✓	✓	–	–	–	–
`rate.viewCost`	✓	✓	–	–	–	–	–

Time tracking

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`time.track`	✓	✓	✓	–	✓	✓	–
`time.edit`	✓	✓	✓	–	✓	✓	–
`time.viewCost`	✓	✓	–	–	–	–	–

Timesheets

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`time.submit`	✓	✓	✓	–	✓	✓	–
`time.viewOthers`	✓	✓	✓	–	–	–	–
`time.editOthers`	✓	✓	✓	–	–	–	–
`time.submitOnBehalf`	✓	✓	✓	–	–	–	–
`time.remind`	✓	✓	✓	–	–	–	–
`time.approve`	✓	✓	✓	–	–	–	–
`time.reopenApproval`	✓	✓	–	–	–	–	–
`time.adjust`	✓	✓	✓	✓	–	–	–
`period.close`	✓	✓	–	–	–	–	–

Time Clock

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`timecard.clock`	✓	✓	✓	✓	✓	✓	–
`timecard.view`	✓	✓	✓	✓	✓	✓	–
`timecard.submit`	✓	✓	✓	✓	✓	✓	–
`timecard.manage`	✓	✓	✓	–	–	–	–
`timecard.submitOnBehalf`	✓	✓	✓	–	–	–	–
`timecard.approve`	✓	✓	✓	–	–	–	–
`timecard.reopen`	✓	✓	–	–	–	–	–

Work schedules

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`schedule.view`	✓	✓	✓	✓	✓	✓	–
`schedule.manage`	✓	✓	–	–	–	–	–

Budgets and money

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`budget.manage`	✓	✓	✓	–	–	–	–
`invoice.manage`	✓	✓	✓	✓	–	–	–
`payment.record`	✓	✓	✓	✓	–	–	–
`expense.submit`	✓	✓	✓	✓	✓	✓	–
`expense.approve`	✓	✓	✓	✓	–	–	–
`expenseCategory.manage`	✓	✓	–	✓	–	–	–

Time off

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`leave.request`	✓	✓	✓	✓	✓	✓	–
`leave.approve`	✓	✓	✓	–	–	–	–
`leave.viewOthers`	✓	✓	✓	–	–	–	–
`leave.managePolicy`	✓	✓	–	–	–	–	–

Reports

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`report.view`	✓	✓	✓	–	✓	–	–
`report.create`	✓	✓	✓	–	✓	–	–
`report.edit`	✓	✓	✓	–	✓	–	–
`report.manage`	✓	✓	–	–	–	–	–
`report.share`	✓	✓	–	–	–	–	–
`report.schedule`	✓	✓	–	–	–	–	–
`report.export`	✓	✓	–	–	–	–	–

Resource Planner

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`block.manage`	✓	✓	✓	–	✓	✓	–
`block.manageOthers`	✓	✓	✓	–	–	–	–

Integrations

Capability	Owner	Admin	Project Manager	Finance	Member	Contractor	Client
`webhook.manage`	✓	✓	–	–	–	–	–

How to read this

Three things decide whether an action succeeds. This table covers only the first.

Check	Question	This page
Capability	May you do this at all?	Yes – the matrix above
Supervision scope	For whom?	Only the default per role
App and plan	Is the area on, and paid for?	No

A Project Manager holds time.approve, but only for people inside their scope. A capability is not a scope. See supervision scope.

Owner-exclusive capabilities

One capability can never be granted to another role, no matter how you build it:

Capability	Why it is reserved
`workspace.delete`	Deleting the workspace is irreversible. Even a custom “admin-like” role is refused this, so an Admin cannot mint a role that deletes the tenant.

Granting ownership itself is also Owner-only. It is not done through the capability list at all – an Owner transfers it deliberately. See change someone’s role.

Capabilities that can be denied per person

Per-person overrides are deny-only. You can take a capability away from one person on top of their role. You can never use an override to grant something the role does not already include.

Capability	Why you would switch it off
`timecard.clock`	Clocking in and out is a working style, not a rank. A contractor who bills by deliverable should not use the clock, while everyone else does.

See per-person permissions.

Capabilities a per-project role can widen

A person can hold a different role on one project. That per-project role is widen-only, and it reaches exactly one capability:

Capability	Effect
`task.reviseEstimate`	A person can be allowed to revise estimates on a single project without holding it workspace-wide.

Every other capability is decided by the workspace role alone. A per-project role can never take something away.

Which capabilities need a scope

These capabilities reach across people, so a supervision scope decides who they apply to. At scope None they have nobody to act on. time.viewOthers · time.editOthers · time.submitOnBehalf · time.reopenApproval · time.remind · time.approve · time.adjust · timecard.manage · timecard.approve · timecard.submitOnBehalf · timecard.reopen · leave.approve · leave.viewOthers · expense.approve · block.manageOthers Everything else is about a thing, not a person. Closing a period, changing workspace settings and managing members are workspace-level administration.

Which roles can be invited

Every role except Owner can be assigned in an invitation. Ownership is never minted at invite time – an existing Owner transfers it. A Client can only be invited from that client company’s page, because a portal contact has to belong to a company. See invite a client contact.

Two roles have a locked capability set

Role	What is locked
Owner	Holds every capability. Scope pinned to Workspace. Cannot be deleted or edited.
Client	Holds no capabilities. Scope pinned to None. Cannot be deleted or edited.

The other five roles are editable, and you can build new ones. See custom roles.

Common questions

Can I give a Member the ability to approve time?

Yes, with a custom role. Copy the Member set, add time.approve, and give the role a supervision scope – otherwise the person has the permission and nobody to use it on.

Why does Finance hold so few capabilities?

Finance owns the money surface, not delivery. Invoices, payments, expenses, expense categories, the audit log and data export. It deliberately does not hold project or task management.

Why can a Contractor not see clients?

client.view is the only difference in that area. A Contractor tracks time and works tasks without seeing your book of business. They also lack the three report capabilities a Member holds.

Does a Project Manager see cost rates?

No. rate.viewCost and time.viewCost stay with Owner and Admin by default, so internal pay data does not travel with delivery responsibility. A PM does hold rate.viewBilling – what you charge.

Can I edit the Owner role?

No. Owner is locked at every capability and at workspace scope. That is what makes it a guaranteed way back into your own workspace.

Capabilities reference

What each capability actually lets you do.

Supervision scope

The other half of every permission check.

Custom roles

Build a role that fits your team.

Per-person permissions

Deny-only exceptions for one person.