Access and security
Who can do what in work management
The four roles against every action, and the two things that are not role-based at all.
Work management authority comes from the organisation role and nothing else. An HR role grants none of it, and this grants no HR access — see Roles and access for why the two ladders are kept apart.
| Owner | Admin | Manager | Member | Guest | |
|---|---|---|---|---|---|
| See work, projects and sprints | Yes | Yes | Yes | Yes | Yes |
| Create and edit work | Yes | Yes | Yes | Yes | — |
| Assign work | Yes | Yes | Yes | Yes | — |
| Delete work | Yes | Yes | Yes | — | — |
| Log your own time | Yes | Yes | Yes | Yes | — |
| See everybody's time | Yes | Yes | Yes | — | — |
| Create and edit projects | Yes | Yes | Yes | — | — |
| Archive a project | Yes | Yes | — | — | — |
| Run sprints | Yes | Yes | Yes | — | — |
| Configure boards | Yes | Yes | Yes | — | — |
| Manage teams | Yes | Yes | Yes | — | — |
| View settings | Yes | Yes | Yes | — | — |
| Change settings | Yes | Yes | — | — | — |
| Invite and manage members | Yes | Yes | — | — | — |
Guest is for somebody outside the organisation
A client contact invited to watch one project. Read-only, and the project restriction is applied when the work is fetched rather than being a thing the interface merely hides.
Customers and the service desk
Both sit on this same ladder rather than a third one. A delivery engineer needs to know who the client is, and an agent answering a customer is doing work management — a separate role for either would mean every organisation configuring two.
| Owner | Admin | Manager | Member | Guest | |
|---|---|---|---|---|---|
| See contacts, companies and deals | Yes | Yes | Yes | Yes | — |
| Edit the commercial record | Yes | Yes | Yes | — | — |
| Delete, merge, erase, suppress | Yes | Yes | — | — | — |
| Read the service desk queue | Yes | Yes | Yes | Yes | — |
| Reply, assign, move and merge tickets | Yes | Yes | Yes | Yes | — |
| Configure states, SLA policies and the help centre | Yes | Yes | — | — | — |
Every member can answer a customer
Deliberately. A desk where only managers can reply, or only managers can see what was asked for, is one where the rest of the organisation has no idea what customers are dealing with. Configuring the desk is the restricted half, because it changes what everybody promises. See Setting up the desk.
Two things role does not decide
- Commenting
- Needs only the right to see work, not to edit it. A client guest is exactly the person with something to say about a project, and a product where the people asking the questions cannot ask them moves the conversation to email — where the answer is not attached to the work.
- Editing a comment
- The author only, whatever role anybody else holds. An administrator rewriting somebody's words under their name is not moderation, it is forgery. Removing one is the moderation action, and it is visible.
Where settings authority is stricter than it looks
Automation is admin-only to write, and read-only to everybody who can see work. A rule reassigns other people's work and moves items on their board, so creating one is an administrative act rather than a personal preference — but *why did my item change* is a question anybody may have, so the rules and their run log are readable by all.
Managers can configure boards and run sprints but cannot change settings — workflow states, work item types, labels and custom fields are organisation-wide vocabulary, and a state renamed by one team changes what every other team's board means.
How quickly a role change applies
Authority is carried in the session token so that ordinary requests need no database round trip. A role change therefore lands within about a minute rather than instantly. Anything that grants HR access re-checks the database rather than trusting the token — see Roles and access.