Access and security
Roles and access
Two independent permission axes, and why a project administrator has no business reading salaries.
Work roles and HR roles are separate ladders
One role governs work management, the other governs HR, and neither grants the other. Every permission belongs to exactly one axis. Collapsing them into a single ladder would mean whoever administers projects can read every salary and passport scan.
Work management roles
| Role | Can |
|---|---|
| Owner | Everything, including billing and deleting the organisation |
| Admin | Manage projects, boards, sprints, members and settings |
| Manager | Run sprints and boards; approve where they are the line manager |
| Member | Ordinary work: issues, comments, their own time |
| Guest | Read-only, and scoped to the project they were invited to |
That is the shape of it. For the same four roles against every individual action — who can archive a project, who can change settings, who can see everybody’s recorded time — see Who can do what in work management.
HR roles
| Role | Can |
|---|---|
| None | See the staff directory, see their own record, book their own leave |
| Manager | The above, plus their own reports' leave and absence |
| Viewer | Read the full HR record — documents, engagements, registers |
| Admin | All of the above plus editing, compensation, and configuration |
A manager sees absence, never personal data
Approving somebody's leave needs a date, not a passport scan. A line manager gets their reports' leave and nothing from the personal or compensation classes — not their credentials, not their documents, not their pay.
For the same four roles against every individual action — who can approve leave, who can see documents, who can edit pay — see Who can see what in HR.
Data classes
- Directory
- Name, job title, department. Everybody with a login.
- Leave
- Absence dates and balances. The subject, their line manager, HR.
- Personal
- Documents, credentials, dependants, addresses, agreements, assets. The subject and HR.
- Compensation
- Pay and allowances. The subject and HR administrators.
Access is applied at the query, so data somebody may not see never reaches their browser at all. A checklist is the one deliberate exception, and has its own rule.
How somebody gets a login in the first place is separate: members and invitations for one at a time, single sign-on and directory provisioning at scale. How the product is defended more generally is in Security.
How quickly a change takes effect
Authority is carried in the session token so ordinary requests do not re-read the database. That snapshot is refreshed at most a minute old, so a role change or a suspended membership takes effect within a minute rather than waiting for somebody to sign in again.