This page describes the permissions that come built into each Role in the system, as well as the maximum level of access each Role is ever allowed to reach.

This page is a companion to the system guide, which explains how Roles, Groups, Dimensions, and permissions work together across the system. If you are looking for an explanation of how permissions are combined and calculated, start there. This page focuses specifically on what each Role includes out of the box, and how far it can be customized.

Every Role in the system has two related, but different, sets of permissions:

• Default Permissions — the permissions a new user automatically receives the moment their account is created with that Role.
• Maximum Permissions — the highest level of access that Role is ever allowed to reach, no matter how an administrator configures it.

Administrators can freely turn a Role's Default Permissions on or off, and can also grant additional permissions to individual users or through Groups. However, no combination of user-level permissions or Group permissions can ever push a user beyond what their Role's Maximum allows. The Role always acts as a ceiling.

Important: Modules (the tabs a user sees, such as Tasks, Time or Invoices) do not have a Maximum setting. There is only a Default configuration for modules.

Every permission in the system exists at two levels for each Role:

• Default — is this permission turned on automatically when a new user of this Role is created?
• Maximum — is an administrator even allowed to turn this permission on for this Role, under any circumstance?

A permission can only ever be active for a user if it falls within that user's Role Maximum. If a Role's Maximum does not allow a permission, it will always appear greyed out on the permissions screen — it cannot be turned on by editing the user directly, and it cannot be turned on by adding the user to a Group.

The Executive Role does not come with Can manage security configuration turned on by default — new Executive users cannot manage other users, groups, or permissions out of the box.

However, this permission does fall within the Executive Role's Maximum. This means an administrator can open a specific Executive user's permissions (or a Group that user belongs to) and turn this permission on, if the business need arises.

The Guest Role is the most restricted Role in the system. On the permissions screen, every permission for Guest appears unchecked, and only three of them can even be clicked: Can see other user's tasks, Can see other users' time entries, and Can see actual expenses paid by other users. Every other permission is greyed out.

This means a Guest's Maximum only ever allows visibility into that specific data — never the ability to create, edit, or delete anything. No administrator can change this by editing a Guest user or by adding them to a Group; the Role itself does not allow it.

Important: Administrators may enable any permission that falls within a Role's Maximum but is currently off by default. Permissions that fall outside the Maximum can never be enabled for that Role, through any method.

System Permissions control access to system-wide actions that are not tied to a specific Project, Client or other piece of data — things like managing users, managing templates, or seeing other people's time entries.

The table below shows which System Permissions are turned on by default for each Role. A checkmark (✓) means the permission is active the moment a new user of that Role is created. A blank cell means the permission starts off — it may still be turned on later, depending on whether the Role's Maximum allows it.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

The table below shows the highest level of access each Role is ever allowed to reach. A blank cell means the permission is greyed out on screen and can never be granted to that Role — not by editing a user directly, and not through a Group.

How to read this table together with the Default table above:

• Checked in Default → active from day one; an administrator may switch it off.
• Unchecked in Default, but checked here in Maximum → off right now, but an administrator can turn it on.
• Unchecked in both tables → permanently unavailable to that Role.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

Modules are the tabs a user sees across the top of the application — such as Tasks, Time, Expenses or Invoices. Unlike System Permissions, modules do not have a Maximum: a Role either includes a module by default, or it does not appear for that Role at all unless an administrator adds it.

Additional modules — such as Email, Projects, Customers, Forms, Tickets, Workspaces and Tags — are provided by optional modules and only appear once the corresponding module has been installed and enabled.

The table below shows which of the ten core modules each Role sees by default.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

Note: As a general rule, every additional module (Email, Projects, Customers, Forms, Tickets, Workspaces, Tags) is visible only to Super Administrator, Administrator, Manager, and Executive by default. Collaborators and Guests never receive an additional module automatically — an administrator must grant it manually if needed. Workspaces and Tags, specifically, are created disabled and must be switched on before any Role can see them.

While System Permissions control system-wide actions, Object Permissions control what a user can do with individual records — Tasks, Files, Expenses, Invoices, and so on — once they already have access to the Project, Client, or other dimension member that record belongs to.

There are three levels of object access:

• Read — view the object.
• Write — create and edit the object.
• Delete — remove the object.

A note on Read access: Unlike Write and Delete, Read access is not set directly by a Role. Instead, it depends on whether the user (or a Group they belong to) has been granted access to the Project, Client, Workspace, or other dimension member the object belongs to. In practice, this means: sharing a Project with a user or Group gives them read access to the object types included in that share. Their Role then determines how much further beyond reading they are allowed to go.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

Note: Invoices cannot be deleted by Manager or Executive by default — they may only create and edit them. This is intentional, to protect confirmed billing records.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

Note: additional object types provided by optional modules — such as Mail, Forms and Tickets — generally follow the same pattern: full create/edit/delete access for Super Administrator, Administrator and Manager, and no access for Collaborators or Guests. Executive typically receives create/edit access on Mail, and full create/edit/delete access on Forms and Tickets.

Note: objects that are not filed under any Project, Client, or other dimension member follow a separate, more restrictive set of rules, and are generally only accessible to Super Administrator, Administrator, Manager, and Executive when this behavior has been specifically enabled for the installation.

The permissions described earlier on this page are part of the base product and are available on every installation. In addition to those, some modules add permissions of their own. These extra permissions only appear on the permissions screen once the module that provides them has been installed and enabled — on an installation without that module, they simply do not exist.

There is an important detail worth knowing: not every module adds a visible tab. Some modules add a tab at the top of the screen (like Expenses), while others add permissions only and change nothing visually. This means you cannot always tell whether a module is installed just by looking at the tabs.

To check exactly which modules are active on your installation, go to Administration → Plugins. The table below includes the name each module displays on that screen, so you can find it quickly.

Note: If a permission listed above does not appear on your permissions screen, the module that provides it is not currently active on your installation. Keep in mind that Mail Templates and Billing & Cost add permissions only — they do not add a visible tab — so the only reliable way to confirm whether they are installed is to check Administration → Plugins.

Just like the base permissions, these follow the Default and Maximum model. The table below shows which of them are turned on by default for each Role, once the corresponding module is installed.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

This table shows the highest level each Role is ever allowed to reach for these permissions. A blank cell means the permission is greyed out on screen and can never be granted to that Role — not by editing a user directly, and not through a Group.

Role abbreviations used in this table:
SA = Super Administrator · AD = Administrator · MG = Manager · EX = Executive · IC = Internal Collaborator · EC = External Collaborator · CC = Collaborator (Customer) · GU = Guest · GC = Guest (Customer) · ND = Non-Executive Director

• Use each Role's Default Permissions whenever possible, instead of customizing individual users.
• Use Groups to manage permissions for multiple users with similar responsibilities, rather than configuring each user one by one.
• Avoid granting permissions to individual users unless there is a specific, ongoing business reason to do so.
• Review a Role's Maximum Permissions before creating or customizing a Role, so you know in advance what will and will not be possible.
• Configure Role Default Permissions to speed up and standardize the process of creating new users.
• Configure Default Dimension Member Permissions so that access to new Projects, Clients and Workspaces does not require repetitive manual setup.

• Every Role has Default Permissions (what a new user gets automatically) and Maximum Permissions (the ceiling that can never be exceeded).
• Administrators can freely enable or disable anything within a Role's Maximum. Anything outside the Maximum is permanently unavailable, no matter how a user or Group is configured.
• Super Administrator and Administrator have full access to virtually everything.
• Manager runs day-to-day operations — Projects, team, time and billing — but cannot manage system configuration or dimensions, and cannot delete invoices.
• Executive works across nearly every object type, but does not manage billing, time entries, task templates or configuration by default.
• Internal Collaborator, External Collaborator and Collaborator (Customer) can work on assigned data and link objects, but cannot create or assign tasks, and have no access to financial or administrative areas.
• Guest and Guest (Customer) are the most restricted Roles: their Maximum only ever allows visibility into specific data, never editing.
• Non-Executive Director is an oversight Role: it can see other users' tasks, time entries, expenses and billing figures, with no editing rights anywhere.
• Modules (tabs) have Defaults only — there is no Maximum for modules.
• Read access to objects is controlled separately from Write and Delete, through Project/Client/Workspace sharing rather than through the Role itself.