Roles & permissions

Roles & permissions is where an org admin controls what each role can do and which data each role can see. Find it in the sidebar under the Admin section of the Workspace area (it’s hidden unless you’re an org admin).

This page sets the rules by role. You assign specific people to roles somewhere else — see Assigning people to roles below.

The roles

There are seven project roles, plus a fixed Org admin:

• Sponsor — client decision-maker
• PM — project manager (your firm)
• Co-owner — joint-venture partner PM, same as PM
• Contributor — designer / consultant, with read access but no writes
• Viewer — read-only across the project
• Client viewer — client-side read-only
• Finance — read-only, but trusted to see internal and financial items

Org admin has full access to everything and can’t be edited, so you can’t accidentally lock yourself out. It shows as an always-ticked column in the permission matrices.

The permission matrix

Two grids set what each role can do. Tick a cell to grant that role a permission; untick to remove it.

• Project permissions — actions on a project’s own data (risks, issues, decisions, actions, stakeholders, settings, and so on). Each role has its own column.
• Workspace permissions — workspace-wide resources (organisations, users, Slack, tracker…), governed by org membership rather than a project role. Here only reads can be granted to any member; writes stay org-admin only.

Confidentiality tiers

A confidentiality tier is a visibility level on a piece of data. The tier on an item is assigned by the classifier (and confirmed in review) — this page only sets who can see each tier:

Tier	Who can see it
Project	Everyone with access to the project
Internal	The roles you tick
Admin only	The roles you tick
Audience	Only the named recipients set on that item, plus org admin

You can edit the Internal and Admin only columns. Project and Audience aren’t role-based, so they’re shown as fixed notes. Org admin always sees every tier.

Note

An empty column under a tier means nobody but org admin can see items at that tier.

Assigning people to roles

You don’t add people here. You grant a person a role inside the project, under Settings → Team, where you add a workspace member and pick their role. This page only defines what each role means. See Create a project for how project access works, and the Glossary for the terms used here.