Permissions are granted to groups, never to individual users. What a user may do is the union
of everything their groups grant; one group never takes away what another gives. Administrators
bypass permission checks entirely.
The page
Administration → Groups & permissions needs the manage groups & permissions permission.
Two groups are created with the workspace: All users, which applies to everyone and grants
the everyday permissions (create, edit and delete work items, estimate, projects, customers, the
Gantt chart, start restrictions, using the AI companion), and Supervisors, with no members at first, for the
oversight permissions (other projects on the board, override start restrictions, reorganize work,
customer financials and files, work teams, tag locking, reports, the activity feed). Both are
ordinary groups: rename, change or delete them as you like.
Editing a group
The Group name must be unique.
The permission matrix, one card per category. Some permissions imply others: estimate work
and change spent value also grant edit work items; use the AI companion also grants
create projects. Categories of features an administrator turned off are hidden, and the Gantt
permission is locked while the chart is disabled.
Members: Apply to all users (no member list needed), a hand-picked list of users, or
Link members to a team so the membership follows a work team.
Changes take effect immediately: affected users' screens refresh without a reload. Deleting a group
removes its members and grants after confirmation.
What each permission does
Permissions only ever add abilities. Seeing a work item is not a permission: it is decided by the
item's restriction, and customers, work teams and tags are visible to
everyone once their feature is turned on.
Work items
Permission
What it allows
Create work items
Add phases, tasks and subtasks to a project (from the work list, the editor's related items, the organizer or the board), and create repeating tasks.
Edit work items
Change a work item you can see: its fields, status, priority, assignment (including Take), item type and estimate amounts. Without it work items open read-only. Changing a project's status or priority from the board also needs it.
Delete work items
Delete phases, tasks and subtasks, from the editor or the organizer. Projects need delete projects instead.
Can estimate work
Open and edit the estimate tracker on a work item. Without it the tracker cannot be expanded and estimate changes are rejected. Also grants edit work items.
Can change spent value
Overwrite a work item's total spent value with the tracker's Change option, which may lower it. Logging additional spent time or value does not need it. Also grants edit work items.
Set start restrictions (start date and dependencies)
Turn the cannot start before start date switch on or off, and add or remove the items a work item may not start until. Without it those controls are read-only and your saves keep the stored values.
Override start restrictions (start date and dependencies)
Get an item going despite a restriction someone set: change the status of an item whose start date is still in the future, or whose dependencies have not started or finished yet. Applies to projects, phases, tasks and subtasks.
Reorganize project work items
Use the project organizer to move items into another project, phase or task and restructure phases, tasks and subtasks. Creating or deleting items there still needs the create and delete permissions.
View the Gantt chart
Open the project timeline. Without it the menu entry is hidden. It only opens the chart: each item still follows its own visibility rules. Locked while the Gantt chart is turned off in the configuration.
Upload attachments
Upload files on a work item's Attachments tab, and create, rename or delete its folders and files. File names are visible to anyone who can open the item; only managing them needs this permission.
Download attachments
Download the content of a work item's attachments. Either way, the files follow the item: an item you cannot open never shows its attachments.
Projects
Permission
What it allows
Can create projects
Create new projects, clone existing ones and turn an AI-generated plan into a project.
Can edit projects
Edit a project's details and open its options. Without it the project opens read-only. Separate from edit work items: one does not imply the other.
Can delete projects
Delete a project with everything in it, from the project's options page.
Can see other projects on the board
Use the board's project selector to look at other projects. Without it the selector is hidden and the board stays on your default project scope.
Customers
Permission
What it allows
Create customers
Add customers.
Edit customers
Change a customer's details, contacts, custom fields and tags. Fees also need see financial information.
Delete customers
Delete customers, from the customer's edit form.
See financial information
See a customer's fees, and change them together with edit customers. Without it fee values are hidden everywhere.
Upload files
Upload customer files and create or delete folders and files. File names are visible to anyone who can open the customer; only managing them needs this permission.
Download files
Download the content of a customer's files.
Manage customer groups
Create, edit and delete customer groups and assign customers to them. Without it the menu entry is hidden; choosing a group on a customer does not need it.
Work teams
Permission
What it allows
Manage work teams
Create, edit and delete work teams and their members. Without it the menu entry is hidden; picking a team on a work item does not need it.
Tags
Permission
What it allows
Lock and unlock tags
Lock a tag so nobody without this permission can edit or delete it, and unlock it again. Holders can still edit or delete a locked tag. Anyone may create and maintain unlocked tags.
Reports
Permission
What it allows
View the spent time/value report
Open the spent report. It is a workspace-wide aggregate: item restrictions are not applied to its rows.
Open Saved reports, run the reports built by you or shared with you, and download them as PDF or spreadsheet. It gates the page and the file, not the data: a report only ever shows rows and columns its runner could already see on the feature's own screen.
Create, edit and share report definitions
Open the Report builder, preview, save and share reports, and edit or delete your own. Editing somebody else's report still needs to be its owner or an administrator.
AI companion
Permission
What it allows
Configure the AI companion (provider & API key)
Open the AI companion settings and change the provider and API key.
Use the AI companion (generate project plans, draft work items)
Generate a project plan and turn it into work items, and draft a work item’s fields in its editor. Since generating creates a project, it also grants create projects.
Public intake forms
Permission
What it allows
Design public intake forms
Open Public forms: create, edit and delete them, switch them on or off, and choose the project they file into and the account their tickets are created as. Reading what a form produced does not need it — a submission is an ordinary work item. Hidden while public forms are turned off in the configuration.
Security
Permission
What it allows
Manage groups & permissions
Open this page: create, edit and delete groups, choose their members and grant their permissions.
View activity feed
Open the activity feed: a workspace-wide log of recorded changes — who changed what, and when. Like the reports, it is a supervisory view: item restrictions are not applied to its entries.
View security log
Open the security log for the whole workspace: every account's sign-ins and refused attempts with their addresses, blocks, password changes and role or group changes. Separate from the activity feed on purpose, and granted to no group by default. Everyone can see their own account's history without it.
Workspace
Permission
What it allows
Export all of the workspace's data
Take a copy of everything the workspace owns: start an export, follow it and download its archive. The archive holds every item, including those restricted to one person or to one team, so granting this is granting sight of all of the workspace's data. Granted to no group by default. It keeps working while the workspace is read-only.