Skip to main content
If none of the built-in roles fits, build your own. Settings → Roles lets you create a role, tick exactly the permissions it needs, and decide whose data it can reach. You need the role.manage capability.

​
When to create a custom role

Good reasons

A bookkeeper who records payments but never sees cost rates. A team lead who approves timesheets for one group. An auditor who reads reports and nothing else.

Not a reason

One person needs one thing switched off. Use a per-person exception, or accept the nearest role – see per-person permissions.

​
The Roles page

Go to Settings → Roles. The page is described as What each role can do in this workspace. One card, All roles, described as System roles are fixed; create custom roles for anything in between. A New role button sits in its header. A search box with the placeholder Search roles… sits above the table. Empty state: No roles yet – create one to get started. Row actions are a pencil to edit (or view, when locked), a reassign icon when the role has members, and the archive and delete menu on roles that are not locked.

​
Which roles you can edit

Owner and Client are locked. Their permissions cannot be edited and they cannot be deleted. Opening one shows a read-only view: This is a built-in role. You can see what it does, but not change it.The Owner role must always hold everything, and the Client role must always hold nothing. Those two invariants are what keep the whole permission model honest.

​
Create a role

1

Open Roles

Go to Settings → Roles.
2

Click New role

The dialog opens. Its description reads Choose what this role can see, and what it can do.
3

Name it

The role name is the dialog title. Type over the placeholder Name this role. Press Enter to commit. Names are up to 40 characters.
4

Set what it can see

Choose an answer to What can this role see? This is the role’s supervision scope.
5

Tick the permissions

Work down the grouped list, or use the search box.
6

Create it

Click Create role. A toast confirms Role created.
There is no description field, and no “copy from” or “duplicate” control. Start from an empty role and tick what you need.

​
The permission list

The permission matrix is headed Permissions with a live counter, 12 of 62 granted. Group headings stay pinned as you scroll. The eleven groups are: If a search matches nothing you see No permissions match "x". Try a different word, or clear the search to see all 62.

​
What can never be granted

Deleting the workspace is owner-exclusive. It is not offered as a checkbox on any other role, and the server refuses it if it is attempted: "workspace.delete" belongs to the owner role and can't be granted to another role.This closes the obvious escalation path – an admin cannot mint an “admin-plus” role that can delete the whole workspace.
Two more powers are keyed to the Owner role itself rather than to a permission, so a custom role cannot pick them up: Everything else in the list can be given to a custom role.

​
What can this role see?

Permissions say may you. Scope says for whom. Both must pass.
A role that can act on other people needs someone to act on. If you tick a cross-member permission and leave the scope at “only their own data”, saving is blocked:This role can act on other people, so it needs someone to act on. Pick whose data it covers, or turn off that permission below.
Scope is set once per role, not per permission. A role that needs workspace-wide leave visibility but group-scoped timesheets is two roles, not one. See supervision scope.

​
Edit a role

Click the pencil on the row. The same dialog opens with Save changes instead of Create role. A toast confirms Role updated. People holding the role pick up the change immediately.

​
Delete a role

What happens depends on whether anyone holds it.

​
Nobody holds it

Use the archive and delete menu on the row, the same as anywhere else in TimeTracker.

​
People hold it

You must say where they go.
1

Click the reassign icon

Its label reads Reassign members of {name} and delete it.
2

Read the warning

The dialog is titled Delete role ""? with the text Its 3 member(s) will be moved to the role you select. This can't be undone.
3

Pick a replacement

The Move members to dropdown lists every role except this one and the locked ones. Its placeholder is Choose a role.
4

Delete

Click Delete role. The button stays disabled until you pick a replacement. A toast confirms Role deleted.
Everyone is moved first, then the role is removed – both in one step, so nobody is ever left without a role. Each move is written to your audit history. You cannot move people to Owner or Client this way.

​
Using a custom role

A custom role behaves exactly like a built-in one.

​
Example

Northwind Studio hires a part-time bookkeeper. Finance is too broad – it can see the audit log and export the whole workspace. Maya creates a role called Bookkeeper:
1

Scope

What can this role see? is set to Everything in the workspace, because invoices span every client.
2

Permissions ticked

Manage invoices, Record payments, Approve or reject expenses, Manage expense categories, View billing rates, View reports.
3

Permissions left off

View cost rates, Export workspace data, Read the audit log, and everything under Members & roles.
4

Result

The counter reads 6 of 62 granted. The bookkeeper can bill clients and chase payments, but never sees what anyone costs Northwind, and cannot export the workspace.

​
Permissions

The permission list describes role.manage as Manage roles & permissions: Create roles, rename them, delete them, and choose what each one can do. This includes handing out permissions they do not have themselves.
role.manage is powerful. Someone with it can create a role holding permissions they do not have themselves, then assign it. Give it only to people you trust with the whole workspace.

​
Common questions

Yes. Only Owner and Client are locked. The other five built-in roles can be renamed, edited and deleted.
No. That one action is reserved to the Owner and is not offered as a checkbox anywhere.
You pick a replacement role, everyone is moved to it, and then the role is removed – all in one step.
There is no duplicate control. Open the role you want to copy, note its ticks, then create a new one.
Four are not offered as checkboxes – deleting the workspace, which is owner-only, and three that are not managed through the role editor.
No. Scope is one setting for the whole role. Split it into two roles if you need two different reaches.

​
Troubleshooting

Roles and capabilities

The permission model.

Supervision scope

Deciding whose data a role reaches.

Capabilities reference

Every permission, one by one.

Change someone's role

Assign the role you built.

Per-person permissions

Exceptions for one person.

Groups

How group scope resolves.