Roles and permissions
Use this page to choose a role for someone, or to decide which permissions to tick when you build your own. To give someone a role or create one, see Invite people and manage their access.
How roles work
- Each person has one role. A role is a set of permissions.
- Administrator can do everything. It isn’t repeated in the tables below.
- Tenant Admin is for running the account, not using the data. People with it only see Settings.
- Line managers see their own area. Without Organization-wide Teams Plan Visibility, people only see the teams they manage and the teams beneath them.
- You can’t give more than you have. You can only invite someone with a role whose permissions you hold. People who can’t see detailed financials can’t add pay permissions to roles they create.
- API keys use the same permissions. See Create and manage API keys.
Built-in roles
| Role | Who it’s for |
|---|
| Administrator | Full access to all features and settings |
| Config Admin | Full settings access, all team and roadmap management, but no financial visibility |
| Financial Manager | Full financial visibility and team management with compensation control |
| Team Manager | Full team and roadmap management without financial visibility or compensation control |
| Line Manager | Team-scoped financial visibility and management, can approve effort tracking |
| Team Member | View access to all data except financials, can submit effort tracking |
| Viewer | Read-only access to non-financial data |
| AI Viewer | Sees only their own AI usage. No access to planning, financials or settings. |
| Tenant Admin | Settings only. Can’t see organisation data. |
Permissions
Permission names match what you see when you create or edit a role. The last column lists the built-in roles, other than Administrator, that include each one.
Functional groups
You can also share individual functional areas with people directly. See Functional groups.
| Permission | Lets someone | Built-in roles |
|---|
| Open functional groups | Open the functional groups section. Area sharing still decides which records they see. | None |
| Read all functional groups | Read every functional area | None |
| Edit all functional groups | Create top-level groups, and manage structure and staffing in every functional area | None |
| Share functional groups | Choose who can edit or read each functional area | None |
Settings - Entity Configuration
| Permission | Lets someone | Built-in roles |
|---|
| View Entity Configuration | See organisation settings such as job roles, departments and locations | Config Admin, Tenant Admin |
| Create Entity Configuration | Add those items | Config Admin, Tenant Admin |
| Update Entity Configuration | Change those items and organisation settings | Config Admin, Tenant Admin |
| Delete Entity Configuration | Remove those items | Config Admin, Tenant Admin |
Settings - Financial Configuration
| Permission | Lets someone | Built-in roles |
|---|
| View Financial Configuration | See currencies, fiscal year and cost centres | Config Admin, Tenant Admin |
| Create Financial Configuration | Add financial settings | Config Admin, Tenant Admin |
| Update Financial Configuration | Change financial settings | Config Admin, Tenant Admin |
| Delete Financial Configuration | Remove financial settings | Config Admin, Tenant Admin |
Settings - Data Import
| Permission | Lets someone | Built-in roles |
|---|
| Data Import | Import employees, teams, projects and other data | Config Admin, Tenant Admin |
Settings - Roles & Permissions
| Permission | Lets someone | Built-in roles |
|---|
| View Roles & Permissions | See roles and their permissions | Config Admin, Tenant Admin |
| Create Roles | Create roles | Config Admin, Tenant Admin |
| Update Roles | Change roles, invite people, and reset someone’s second factor | Config Admin, Tenant Admin |
| Delete Roles | Remove roles | Config Admin, Tenant Admin |
| Invite Users | Invite people. Give it together with Update Roles. | Config Admin, Tenant Admin |
Settings - Integrations
| Permission | Lets someone | Built-in roles |
|---|
| View Integrations | See connected tools, such as Jira, Linear and Azure DevOps | Config Admin, Tenant Admin |
| Create Integrations | Connect tools | Config Admin, Tenant Admin |
| Update Integrations | Change connected tools’ settings | Config Admin, Tenant Admin |
| Delete Integrations | Remove connected tools | Config Admin, Tenant Admin |
Financial Detail
| Permission | Lets someone | Built-in roles |
|---|
| View Financial Summary | See charts, totals and other summarised financial figures | Financial Manager, Line Manager |
| View Detailed Financials | See individual salaries, bonuses and other pay | Financial Manager, Line Manager |
| Export CapEx Rationales | Export CapEx rationales and their project cost calculations in bulk | Financial Manager |
Team Plan - Employees
| Permission | Lets someone | Built-in roles |
|---|
| View Employees | See employee profiles | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Employees | Add employees | Config Admin, Financial Manager, Team Manager, Line Manager |
| Update Employees | Change employee details other than pay | Config Admin, Financial Manager, Team Manager, Line Manager |
| Delete Employees | Remove employees | Config Admin, Financial Manager, Team Manager, Line Manager |
| Modify Employee Compensation | Change salaries, bonuses and other pay | Financial Manager |
| Bulk-Modify Employee Compensation | Apply one salary change to every employee matching a filter | Financial Manager |
Team Plan - Teams
| Permission | Lets someone | Built-in roles |
|---|
| View Teams | See teams and how they’re structured | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Teams | Create teams | Config Admin, Financial Manager, Team Manager |
| Update Teams | Change teams | Config Admin, Financial Manager, Team Manager |
| Delete Teams | Remove teams | Config Admin, Financial Manager, Team Manager |
Team Plan - Global Permissions
| Permission | Lets someone | Built-in roles |
|---|
| Organization-wide Teams Plan Visibility | See people and the cost forecast across every team. Without it, people only see the teams they manage and the teams beneath them. Includes List All Teams. | Config Admin, Financial Manager, Team Manager, Tenant Admin |
| List All Teams | Pick any team when browsing, assigning or moving people, contractors and vacancies, without seeing other teams’ people or cost | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
Team Plan - Contractors
| Permission | Lets someone | Built-in roles |
|---|
| View Contractors | See contractor profiles | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Contractors | Add contractors | Config Admin, Financial Manager, Team Manager, Line Manager |
| Update Contractors | Change contractor details other than rates | Config Admin, Financial Manager, Team Manager, Line Manager |
| Delete Contractors | Remove contractors | Config Admin, Financial Manager, Team Manager, Line Manager |
| Modify Contractor Compensation | Change contractor rates | Financial Manager |
| Bulk-Modify Contractor Compensation | Apply one rate change to every contractor matching a filter | Financial Manager |
Team Plan - Vacancies
| Permission | Lets someone | Built-in roles |
|---|
| View Vacancies | See vacancies | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Vacancies | Add vacancies | Config Admin, Financial Manager, Team Manager, Line Manager |
| Update Vacancies | Change vacancy details other than target salary | Config Admin, Financial Manager, Team Manager, Line Manager |
| Delete Vacancies | Remove vacancies | Config Admin, Financial Manager, Team Manager, Line Manager |
| Modify Vacancy Compensation | Change a vacancy’s target salary | Financial Manager |
| Bulk-Modify Vacancy Compensation | Apply one target-salary change to every vacancy matching a filter | Financial Manager |
Team Plan - Skills
| Permission | Lets someone | Built-in roles |
|---|
| View Skills | See skills | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Skills | Add skills | Config Admin, Financial Manager, Team Manager |
| Update Skills | Change skills | Config Admin, Financial Manager, Team Manager |
| Delete Skills | Remove skills | Config Admin, Financial Manager, Team Manager |
Roadmap - Projects
| Permission | Lets someone | Built-in roles |
|---|
| View Projects | See projects and who’s allocated to them | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Projects | Create projects | Config Admin, Team Manager |
| Update Projects | Change projects | Config Admin, Team Manager |
| Delete Projects | Remove projects | Config Admin, Team Manager |
Roadmap - Initiatives
| Permission | Lets someone | Built-in roles |
|---|
| View Initiatives | See initiatives | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Initiatives | Create initiatives | Config Admin, Team Manager |
| Update Initiatives | Change initiatives | Config Admin, Team Manager |
| Delete Initiatives | Remove initiatives | Config Admin, Team Manager |
Roadmap - Drivers
| Permission | Lets someone | Built-in roles |
|---|
| View Drivers | See business drivers | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Drivers | Create drivers | Config Admin, Team Manager |
| Update Drivers | Change drivers | Config Admin, Team Manager |
| Delete Drivers | Remove drivers | Config Admin, Team Manager |
Cost Forecast
| Permission | Lets someone | Built-in roles |
|---|
| View Forecast | See the cost forecast | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Create Budget Snapshot | Freeze the current forecast as the budget for a fiscal year | Config Admin, Financial Manager |
Scenario Plans
| Permission | Lets someone | Built-in roles |
|---|
| Use Scenario Plans | Create scenarios and submit them for review | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member |
| Edit Scenario Plans | Change employees, teams, allocations and other data in draft scenarios | Config Admin, Financial Manager, Team Manager, Line Manager |
| Edit Compensation in Scenario Plans | Change salaries, contractor rates and bonuses in a draft scenario or budget proposal, without full scenario editing | None |
| Merge Scenario Plans | Merge a scenario’s changes into live data | Config Admin, Financial Manager |
Effort Tracking
| Permission | Lets someone | Built-in roles |
|---|
| View Effort Tracking | See effort reports | Config Admin, Financial Manager, Team Manager, Line Manager, Team Member, Viewer |
| Submit Effort | Submit effort | Team Manager, Team Member |
| Override Effort | Change submitted effort | Financial Manager, Line Manager |
| Approve Effort | Approve submitted effort | Financial Manager, Line Manager |
| View Contractor Effort | See contractor effort, grouped by company | Financial Manager, Line Manager |
| Modify Contractor Effort | Change contractor effort | Financial Manager, Line Manager |
Audit
| Permission | Lets someone | Built-in roles |
|---|
| View Audit | See audit evidence and reports | Config Admin, Financial Manager, Team Manager, Line Manager |
| Configure Audit | Set audit criteria and the effort review settings | Config Admin |
| Confirm Audit Evidence | Confirm audit evidence | Config Admin |
| Export Audit Reports | Export audit-ready reports | Config Admin, Financial Manager |
Settings - API Keys
| Permission | Lets someone | Built-in roles |
|---|
| View API Keys | See API keys | Config Admin, Tenant Admin |
| Create API Keys | Create API keys | Config Admin, Tenant Admin |
| Revoke API Keys | Revoke API keys | Config Admin, Tenant Admin |
Settings - Auth Providers
| Permission | Lets someone | Built-in roles |
|---|
| View Auth Providers | See single sign-on providers | Config Admin, Tenant Admin |
| Create Auth Providers | Add single sign-on providers | Config Admin, Tenant Admin |
| Update Auth Providers | Change single sign-on providers and their group mappings | Config Admin, Tenant Admin |
| Delete Auth Providers | Remove single sign-on providers | Config Admin, Tenant Admin |
Settings - SIEM Integration
| Permission | Lets someone | Built-in roles |
|---|
| View SIEM Integration | See SIEM endpoints and keys, and open the activity log | Config Admin, Tenant Admin |
| Configure SIEM Integration | Add, change and delete SIEM endpoints and keys | Config Admin, Tenant Admin |
Settings - Webhooks
| Permission | Lets someone | Built-in roles |
|---|
| View Webhooks | See webhook endpoints and their delivery logs | None |
| Configure Webhooks | Add, change, delete and test webhook endpoints | None |
Settings - SCIM Provisioning
| Permission | Lets someone | Built-in roles |
|---|
| View SCIM Provisioning | See SCIM tokens and provisioned people | Config Admin, Tenant Admin |
| Configure SCIM Provisioning | Create and revoke SCIM tokens | Config Admin, Tenant Admin |
R&D Tax Relief
| Permission | Lets someone | Built-in roles |
|---|
| View R&D Tax Relief | See R&D claims, qualifying activities and reports | Config Admin, Financial Manager, Team Manager, Line Manager, Viewer |
| Create R&D Tax Relief Claims | Create R&D claims and qualifying activities | Financial Manager |
| Update R&D Tax Relief Claims | Change R&D claims and qualifying activities | Financial Manager |
| Delete R&D Tax Relief Claims | Remove R&D claims and qualifying activities | Financial Manager |
| Approve R&D Tax Relief Claims | Approve R&D claims for submission | Financial Manager |
| Export R&D Tax Relief Reports | Export R&D reports and supporting documents | Financial Manager |
| Configure R&D Tax Scanner | Set the rules for finding qualifying R&D work | Config Admin |
Budgets & Scenarios
Team Manager, Line Manager and Team Member only work on the budget proposals they own or are assigned.
| Permission | Lets someone | Built-in roles |
|---|
| View Budget Requests | See budget requests and proposals | Config Admin, Financial Manager |
| View Budget Requests (Your Teams) | See budget requests and proposals for the teams they manage, are assigned or approve | Config Admin |
| Create Budget Requests | Start a budget cycle | Config Admin, Financial Manager |
| Edit Budget Proposals | Edit proposals for their assigned teams | Config Admin, Team Manager, Line Manager, Team Member |
| Submit Budget Proposals | Submit proposals for approval | Config Admin, Team Manager, Line Manager, Team Member |
| Approve Budget Proposals | Approve submitted proposals | Config Admin, Team Manager, Line Manager |
| Merge Budget Proposals | Merge approved proposals into live data | Config Admin, Financial Manager |
| Lock Budget Request | Lock a budget after financial approval | Config Admin, Financial Manager |
| View Budget Configuration | See budget settings | Config Admin, Financial Manager |
| Update Budget Configuration | Set budget approval rules | Config Admin, Financial Manager |
AI Telemetry
| Permission | Lets someone | Built-in roles |
|---|
| Manage AI Telemetry Keys | Connect AI providers, and create and revoke AI telemetry keys for other people | None |
AI Governance
| Permission | Lets someone | Built-in roles |
|---|
| Administer AI Governance | Write AI policies, see where they’re enforced, override consequences, and download evidence packs | None |
AI Fluency
| Permission | Lets someone | Built-in roles |
|---|
| View Individual AI Fluency Scores | See each employee’s AI Fluency score across the organisation. Line managers see their direct reports without it. | Financial Manager |
Business Metrics
| Permission | Lets someone | Built-in roles |
|---|
| View Business Metrics | See what each business function produces and what a unit of it costs | Config Admin, Financial Manager, Viewer |
| Manage Business Metrics | Define metrics, connect their sources and enter readings | Config Admin |
| Ingest Business Metric Readings | Send metric readings through the REST API. Give it on its own to the API key an outside system uses. | Config Admin |