Roles & permissions

Platform roles sit above normal tenant access.

• User — standard application user
• Admin — platform admin utilities where enabled
• Super User — full cross-org superadmin access, including the Administration area

Most users never need a platform role above User.

Every user also has an org-level role:

• Owner — full access to everything including billing. Automatically assigned admin on all modules.
• Org Admin — can manage members, org settings, and all projects. Automatically assigned admin on all modules.
• Member — access controlled by project membership and role template
• Viewer — restricted org-level access where used

Org roles are set when inviting a user and can be changed under Organisation → Members.

Each project member is assigned a role template which defines their permission level across every module.

8 built-in system templates:

You can also create custom templates under Organisation → User Control / role templates.

Each module has one of four permission levels per member:

• None — module is hidden from the sidebar and all API routes return 403.
• View — read-only. Can see data but cannot create, edit, or delete. A lock icon appears on the sidebar link.
• Edit — can create, edit, upload, comment. Cannot delete or configure module settings.
• Admin — full access: create, edit, delete, configure, manage module settings.

Org owners and Org Admins always have Admin on all modules regardless of project role template.

Sometimes a team member needs a different access level for a specific module without changing their entire role template.

In Project Settings → Team, expand any member's row to see the per-module permission grid. Click any module's level to override it for that member only.

Overrides take precedence over the role template. Remove an override to revert to the template's default.

To give an internal or external person access to specific parts of a project:

1. Invite them as an org Member (not Org Admin).
2. Add them to the relevant project.
3. Assign the Consultant or Stakeholder template (or create a custom one).
4. Use per-member overrides to restrict to exactly the modules they need.

They will only see the modules they have access to — the rest are hidden from their sidebar.