> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timetracker.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Per-person permissions

> Switch a single permission off for one person in TimeTracker without changing their role – how deny-only exceptions work and why they can never grant access.

Sometimes one person needs one thing switched off, and changing their whole role would be wrong. TimeTracker handles that with a **per-person exception**.

An exception can only take something away. It can never give someone a permission their role does not already have.

## The rule: exceptions are subtract-only

This is the whole design, and it is worth stating plainly.

<Warning>
  A per-person exception is **deny-only**. It removes a permission the role grants. It can never add one.

  That is a security property, not a limitation. Because no exception can widen access, nobody who manages people can quietly grant themselves – or anyone else – more than their role already allows.
</Warning>

So the answer to "can I give just this one person the ability to approve timesheets?" is no. Permissions come from roles. If someone needs something extra, change their role or [build a custom role](/team/custom-roles).

## How the three layers stack

A request is allowed only when it survives all three checks.

<Steps>
  <Step title="Does their role grant it?">
    If the role does not hold the permission, the answer is already no. Nothing below can change that.
  </Step>

  <Step title="Is there a per-person exception?">
    An exception on their record can withdraw a permission the role granted.
  </Step>

  <Step title="Does where they are allow it?">
    If you use location rules, being outside an allowed place can withdraw more permissions for that moment.
  </Step>
</Steps>

Layers 2 and 3 both only ever subtract. Layer 3 is judged fresh on every request, so it changes as the person moves. Layer 2 travels with the person everywhere.

## What you can switch off today

One exception is available on the member record: **clocking in and out**.

<Note>
  This exists because clocking in and out is a working style, not a rank. A field engineer and an office designer might hold exactly the same role, but only one of them punches a clock.
</Note>

### The Clock in and out switch

Find it on the member record, on the **Employment** tab, in the card **Time & attendance**. The card is described as `Whether this person clocks in and out, regardless of what their role allows.`

<Steps>
  <Step title="Open their record">
    Go to **Settings → Team Members** and click their name.
  </Step>

  <Step title="Open the Employment tab">
    Scroll to the **Time & attendance** card.
  </Step>

  <Step title="Switch Clock in and out off">
    The switch reads positively – on means they can clock in.
  </Step>

  <Step title="Save">
    Click **Save** on that card. A toast confirms `Employment details saved.`
  </Step>
</Steps>

The switch does not save on its own. It shares the **Save** button with the Employment and Reporting cards on the same tab.

### The three reasons the switch can be off

The explanation under the switch tells you which one applies:

| Message                                                                                                            | What it means                          | What to do                          |
| ------------------------------------------------------------------------------------------------------------------ | -------------------------------------- | ----------------------------------- |
| `Timecards are turned off for this whole workspace. Turn them on in Settings → Apps first.`                        | The Time Clock app is off for everyone | Turn it on in **Settings → Apps**   |
| `Their role doesn't allow clocking in. Change that in Settings → Roles.`                                           | The role does not hold the permission  | Change their role, or edit the role |
| `Off hides the clock button for this person only. Their timecard, past shifts and rates stay exactly as they are.` | This is a real per-person exception    | This is the case you are here for   |

When the app is off, or the role does not grant clocking, the switch is shown off and locked. There is nothing an exception could add – which is the deny-only rule showing through in the interface.

### What switching it off does

| Effect                       | Detail                      |
| ---------------------------- | --------------------------- |
| The clock button             | Hidden for that person only |
| Their existing timecard      | Untouched                   |
| Past shifts                  | Untouched                   |
| Their rates and time entries | Untouched                   |
| Everyone else                | Unaffected                  |

<Warning>
  You cannot switch it off while someone is mid-shift. The message is `They're clocked in right now. Clock them out on their timecard first, then turn this off.`
</Warning>

## Location as a second kind of exception

If you use location rules, a person's current place can withdraw permissions for the duration of that request – for example, stopping someone clocking in from outside the office network.

This layer is different in two ways:

|           | Per-person exception | Location                                     |
| --------- | -------------------- | -------------------------------------------- |
| Set where | On the member record | In location rules                            |
| Applies   | Always, everywhere   | Only while they are outside an allowed place |
| Changes   | When you change it   | As the person moves                          |

Both only subtract. Neither can grant anything.

See [location rules](/location-rules/overview).

## What per-person exceptions are not

<CardGroup cols={2}>
  <Card title="Not a permission matrix" icon="x">
    There is no per-person tick list of all 62 permissions. Permissions live on roles.
  </Card>

  <Card title="Not a way to grant" icon="x">
    Nothing here can give a person a permission their role lacks.
  </Card>

  <Card title="Not deactivation" icon="x">
    Switching **Can open this workspace** off blocks sign-in entirely. That is on the Profile tab, not here.
  </Card>

  <Card title="Not supervision scope" icon="x">
    Scope decides whose data a role reaches, and is set on the role – see <a href="/concepts/supervision-scope">supervision scope</a>.
  </Card>
</CardGroup>

## What to do when you need something narrower

| You want                            | Do this                                                     |
| ----------------------------------- | ----------------------------------------------------------- |
| One person to stop clocking in      | Switch **Clock in and out** off on their record             |
| One person to lose something else   | Move them to a narrower role, or build a custom role        |
| A group of people to lose something | Build a custom role and assign it to them                   |
| Someone to stop signing in at all   | Switch **Can open this workspace** off on their Profile tab |
| Someone to have more permissions    | Change their role – exceptions cannot grant                 |

## Example

Northwind Studio turns on the Time Clock app so office staff record their shifts.

Sarah Lin and Jonas Bergman both hold the **Member** role, which includes clocking in and out. Sarah is in the studio every day. Jonas works remotely and logs his hours against tasks instead.

<Steps>
  <Step title="Tom opens Jonas's record">
    **Settings → Team Members → Jonas Bergman → Employment**.
  </Step>

  <Step title="Switches clocking off">
    In **Time & attendance**, Tom turns **Clock in and out** off and clicks **Save**.
  </Step>

  <Step title="What changes">
    Jonas no longer sees a clock button. Sarah still does. Neither role changed, and Jonas's tracked time, rates and timesheets are exactly as they were.
  </Step>
</Steps>

Later Northwind adds a location rule so clocking in only works on the studio network. That is a second, separate layer – it applies to Sarah when she works from a cafe, and it lifts when she is back in the studio.

## Permissions

| Action                                 | Capability          | Roles that hold it by default |
| -------------------------------------- | ------------------- | ----------------------------- |
| Change the **Clock in and out** switch | `member.changeRole` | Owner, Admin                  |
| Switch access on or off                | `member.changeRole` | Owner, Admin                  |
| Change what a role can do              | `role.manage`       | Owner, Admin                  |
| Manage location rules                  | `location.manage`   | Owner, Admin                  |

The **Time & attendance** card is hidden from anyone without `member.changeRole`.

## Common questions

<AccordionGroup>
  <Accordion title="Can I grant one extra permission to one person?">
    No. Exceptions only ever subtract. To give someone more, change their role or build a custom role.
  </Accordion>

  <Accordion title="Is there a per-person permission checklist?">
    No. There is no per-person matrix of every permission. Roles carry the permissions, and the member record carries exceptions.
  </Accordion>

  <Accordion title="Why is the Clock in and out switch greyed out?">
    Either the Time Clock app is off for the whole workspace, or the person's role does not include clocking. The text under the switch says which.
  </Accordion>

  <Accordion title="Does switching clocking off delete their shifts?">
    No. Their timecard, past shifts and rates stay exactly as they are.
  </Accordion>

  <Accordion title="Does the exception follow them between workspaces?">
    No. It is set on their membership of this workspace only.
  </Accordion>

  <Accordion title="Is this the same as deactivating someone?">
    No. Deactivating blocks sign-in completely and lives on the Profile tab under **Access**.
  </Accordion>
</AccordionGroup>

## Troubleshooting

| Problem                       | Cause                                                   | Fix                                       |
| ----------------------------- | ------------------------------------------------------- | ----------------------------------------- |
| No **Time & attendance** card | You lack `member.changeRole`                            | Ask an owner or admin                     |
| The switch will not turn off  | They are clocked in right now                           | Clock them out on their timecard first    |
| The switch is off and locked  | The app is off, or the role lacks the permission        | Fix whichever the text names              |
| The switch reverted           | You did not click **Save** on that card                 | Toggle it again and save                  |
| Someone can still clock in    | You saved a different card, or the change did not apply | Reopen the tab and check the switch       |
| You need to grant, not deny   | Exceptions cannot grant                                 | Change their role, or build a custom role |

## Related guides

<CardGroup cols={2}>
  <Card title="Custom roles" icon="sliders" href="/team/custom-roles">
    The right tool when you need a different permission set.
  </Card>

  <Card title="Member record" icon="id-card" href="/team/member-record">
    Where the switch lives.
  </Card>

  <Card title="Turn clock access off for one person" icon="clock" href="/time-clock/turn-clock-access-off-for-one-person">
    The same switch, from the Time Clock side.
  </Card>

  <Card title="Location rules" icon="map-pin" href="/location-rules/overview">
    The other subtract-only layer.
  </Card>

  <Card title="Roles and capabilities" icon="shield" href="/concepts/roles-and-capabilities">
    Where permissions actually come from.
  </Card>

  <Card title="Supervision scope" icon="binoculars" href="/concepts/supervision-scope">
    Whose data a role reaches.
  </Card>
</CardGroup>