Skip to main content
Five capabilities govern tasks. This page maps them to the seven roles and explains the two rules people get wrong.

​
The task capabilities

Two nearby capabilities matter too:

​
Role matrix

The roles are a strict subset chain: owner ⊇ admin ⊇ project_manager / finance ⊇ member ⊇ contractor ⊇ client. See /concepts/roles-and-capabilities.

​
Why the lines fall where they do

  • Finance holds none of them. Finance owns the money surface – invoices, payments, expenses – not delivery. It reads history rather than changing the work.
  • Client holds none of them. A portal contact sees only what is explicitly shared with their company, and can comment through the portal.
  • Member and Contractor stop short of delete and bulk edit. Creating work is safe. Removing it, or changing hundreds of rows at once, is not.
  • Estimates are separate from editing. An estimate is a commitment, and moving it changes what the project is measured against.

​
Rule 1: a capability is not a scope

task.edit says you may edit tasks. It does not say which tasks. Two things narrow that further: Being assigned a task is not a grant of the project around it. A task in a project outside your visibility does not appear on your board, in your backlog, or on your own Tasks page – there is no side channel onto projects the board hides. For “whose work”, time.viewOthers plus your supervision scope decide together. See /concepts/supervision-scope and /projects/project-visibility.

​
Rule 2: hiding a control is not the boundary

Every control you see is a convenience. The server checks the capability again on every write. Two consequences:
  • A hidden button means you almost certainly cannot do the thing.
  • A visible button is not a promise. If your capability changed since the page loaded, the save is refused and you get a message.

​
Per-project overrides

One task capability can be widened for a single project: task.reviseEstimate. A workspace can give someone a higher role on one project only. That person then sees the revise-estimate control on that project and nowhere else. An Admin is never narrowed by a lower override on a project. See /team/per-person-permissions.

​
App and plan gating

Two different gates. Do not confuse them. Tasks belong to the Projects & tasks app, which is on by default and part of the Free plan. If someone switches it off in workspace settings, the Tasks page and the project task tabs are gone for everyone, and every task write is refused. Things attached to a task have their own gates: Blockers and recurring tasks are deliberately not gated on the Planner or Invoices. Switching those off never stops you adding a blocker or setting a repeat. See /concepts/apps-and-modules and /concepts/plans-and-features.

​
Who can see cost on a task

The Cost row in a task’s Financials section needs time.viewCost or rate.viewCost. For everyone else the figure is left out of the data entirely, not hidden with styling. By default those live with Owner and Admin. Project Manager sets rates and reads billing rates but does not see cost. See /concepts/rates-explained.

​
What each role can actually do

Everything on a task: create, edit, delete, bulk edit, estimate, manage tags, add budget caps and see cost. Only Owner can delete the workspace itself.

​
Example

At Northwind Studio:
  • Priya Raman (Project Manager) creates WR-142, sets a 6-hour estimate, and bulk-moves six finished tasks into Done.
  • Sarah Lin (Member) edits WR-142, adds the Design tag, comments, attaches a file and tracks 3 hours. She cannot change the estimate, and there is no Delete in her Actions menu.
  • Priya then gives Sarah a per-project override on Website Redesign. Sarah now sees the revise-estimate control on that project only. On Harbor Logistics – Mobile App, she still does not.
  • Daniel Okafor (Finance) opens the project to invoice the hours. He cannot edit a task or post a comment.
  • Ruth Castillo (Client) sees the tasks marked Visible to client, and can reply to Priya in the portal.

​
Common questions

Not through the default roles. Custom roles let a workspace build its own capability bundles – see /team/custom-roles.
Yes, for the capabilities the product allows to be denied per person. See /team/per-person-permissions.
Minting a tag while you type keeps tagging unblocked. Curating the shared vocabulary is a delivery-tier action, so renaming, recolouring and deleting need tag.manage.
Contractor is the narrowest staff role. It works the same tasks as a Member, but the client roster and report building are withheld.
No. Project reach is decided by project visibility, not by assignment. A task in a project you cannot reach does not appear anywhere for you.

​
Troubleshooting

Your role does not hold that capability, or it was changed after the page loaded. Refresh, then check the matrix above.
You can reach the project, which is enough to read it, but you do not hold task.edit.
Either they hold a higher role, or they have a per-project override on that project. Estimates are the one capability that can be widened this way.
The Projects & tasks app was switched off in workspace settings. An Owner or Admin can turn it back on at /settings/apps. Nothing was deleted.
That feature is on the Pro plan – budget caps and the client portal, for example. See /billing/overview.

Roles and capabilities

The seven roles and all 66 capabilities.

Supervision scope

Capability says may, scope says whose.

Project visibility

What decides project reach.

Apps and modules

Switched off versus not on your plan.

Per-person permissions

Overrides and denials.

Plans and features

What Free and Pro include.