Roles & Permissions
Choose what each person on your team can see and change.
Roles let you give each teammate exactly the access their work needs, so a freelancer can work on projects without seeing your client list or your money. Manage them in Settings › Roles & Permissions, which has four tabs: Roles, Members, Permissions, and Audit.
Built-in roles
| Role | What it covers |
|---|---|
| Owner | Everything, including billing and deleting the workspace. |
| Admin | Most settings and all data, except private projects they aren't on. |
| Manager | Day-to-day work, including finance, clients, and HR, except private projects they aren't on. |
| Member | Standard team access, including viewing clients and finance. |
| Contractor | Projects, tasks, time tracking, files, docs, and the calendar. No finance, clients (CRM), HR, sales, automations, AI workers, or settings, and no clock-in. Budgets and rates stay hidden. |
If none of these fits, create a custom role.
Change someone's role
- Open Settings › Roles & Permissions.
- Open the Members tab and find the person.
- Choose the new role from the role selector. The change saves right away.
You're done when the person appears with the new role. Ask them to refresh their browser so their sidebar updates.
To invite someone new as a contractor, use HR › Members › Invite member.
Give one person an extra permission
- On the Members tab, select Manage next to the person.
- Tick the permission they need. Untick it to take it away.
An extra permission adds to the person's role. Unticking it does not remove access their role already gives them, so change the role too if that access should end.
Remove someone from the workspace
When someone leaves, select Remove next to them on the Members tab. You choose who takes over their open work, and they lose access right away. See Remove a teammate.
Good to know
- Built-in roles keep their defaults. Owner and Admin always have every permission. Manager, Member, Contractor, and Client always keep their default permissions; you can add more but not remove them.
- Apps have their own permission. Connecting and managing an app, such as Manage QuickBooks or Manage Xero, is off by default for everyone except the owner, including admins. Turn it on for a role on the Permissions tab or for one person on the Members tab. Exporting to accounting also needs Team Finance Manage.
- Private projects stay private. A project marked Private is visible only to its lead and members, whatever their role. Others see its name as Private project on invoices and time entries. The owner sees every project.
- See who changed what on the Audit tab, which lists recent role, member, and permission changes.