Skip to main content
Sometimes one person needs one thing switched off, and changing their whole role would be wrong. TimeTracker handles that with a per-person exception. An exception can only take something away. It can never give someone a permission their role does not already have.

​
The rule: exceptions are subtract-only

This is the whole design, and it is worth stating plainly.
A per-person exception is deny-only. It removes a permission the role grants. It can never add one.That is a security property, not a limitation. Because no exception can widen access, nobody who manages people can quietly grant themselves – or anyone else – more than their role already allows.
So the answer to “can I give just this one person the ability to approve timesheets?” is no. Permissions come from roles. If someone needs something extra, change their role or build a custom role.

​
How the three layers stack

A request is allowed only when it survives all three checks.
1

Does their role grant it?

If the role does not hold the permission, the answer is already no. Nothing below can change that.
2

Is there a per-person exception?

An exception on their record can withdraw a permission the role granted.
3

Does where they are allow it?

If you use location rules, being outside an allowed place can withdraw more permissions for that moment.
Layers 2 and 3 both only ever subtract. Layer 3 is judged fresh on every request, so it changes as the person moves. Layer 2 travels with the person everywhere.

​
What you can switch off today

One exception is available on the member record: clocking in and out.
This exists because clocking in and out is a working style, not a rank. A field engineer and an office designer might hold exactly the same role, but only one of them punches a clock.

​
The Clock in and out switch

Find it on the member record, on the Employment tab, in the card Time & attendance. The card is described as Whether this person clocks in and out, regardless of what their role allows.
1

Open their record

Go to Settings → Team Members and click their name.
2

Open the Employment tab

Scroll to the Time & attendance card.
3

Switch Clock in and out off

The switch reads positively – on means they can clock in.
4

Save

Click Save on that card. A toast confirms Employment details saved.
The switch does not save on its own. It shares the Save button with the Employment and Reporting cards on the same tab.

​
The three reasons the switch can be off

The explanation under the switch tells you which one applies: When the app is off, or the role does not grant clocking, the switch is shown off and locked. There is nothing an exception could add – which is the deny-only rule showing through in the interface.

​
What switching it off does

You cannot switch it off while someone is mid-shift. The message is They're clocked in right now. Clock them out on their timecard first, then turn this off.

​
Location as a second kind of exception

If you use location rules, a person’s current place can withdraw permissions for the duration of that request – for example, stopping someone clocking in from outside the office network. This layer is different in two ways: Both only subtract. Neither can grant anything. See location rules.

​
What per-person exceptions are not

Not a permission matrix

There is no per-person tick list of all 62 permissions. Permissions live on roles.

Not a way to grant

Nothing here can give a person a permission their role lacks.

Not deactivation

Switching Can open this workspace off blocks sign-in entirely. That is on the Profile tab, not here.

Not supervision scope

Scope decides whose data a role reaches, and is set on the role – see supervision scope.

​
What to do when you need something narrower

​
Example

Northwind Studio turns on the Time Clock app so office staff record their shifts. Sarah Lin and Jonas Bergman both hold the Member role, which includes clocking in and out. Sarah is in the studio every day. Jonas works remotely and logs his hours against tasks instead.
1

Tom opens Jonas's record

Settings → Team Members → Jonas Bergman → Employment.
2

Switches clocking off

In Time & attendance, Tom turns Clock in and out off and clicks Save.
3

What changes

Jonas no longer sees a clock button. Sarah still does. Neither role changed, and Jonas’s tracked time, rates and timesheets are exactly as they were.
Later Northwind adds a location rule so clocking in only works on the studio network. That is a second, separate layer – it applies to Sarah when she works from a cafe, and it lifts when she is back in the studio.

​
Permissions

The Time & attendance card is hidden from anyone without member.changeRole.

​
Common questions

No. Exceptions only ever subtract. To give someone more, change their role or build a custom role.
No. There is no per-person matrix of every permission. Roles carry the permissions, and the member record carries exceptions.
Either the Time Clock app is off for the whole workspace, or the person’s role does not include clocking. The text under the switch says which.
No. Their timecard, past shifts and rates stay exactly as they are.
No. It is set on their membership of this workspace only.
No. Deactivating blocks sign-in completely and lives on the Profile tab under Access.

​
Troubleshooting

Custom roles

The right tool when you need a different permission set.

Member record

Where the switch lives.

Turn clock access off for one person

The same switch, from the Time Clock side.

Location rules

The other subtract-only layer.

Roles and capabilities

Where permissions actually come from.

Supervision scope

Whose data a role reaches.