Access is a question with two answers
What someone can do, and who they can do it to. When access is one toggle called admin, small teams end up handing everybody the keys and hoping.
Included on every plan, including the 30-day free trial · Roles are custom, not a fixed list you choose from.What they can do
Who they can do it to
Company
One question, and you answer it wrong.
Admin, or not admin. There is no setting on that switch for “runs payroll, has never needed to see a board” — so the switch gets pushed to one end and left there.
The knob ends up at the right-hand end, not because anyone decided it should, but because the left-hand end makes the work impossible.
A grid for what, and an object for who to
Access is granted per capability rather than by a blunt admin-or-not switch, so a payroll clerk never needs to see what a team lead sees.
| Resource | Owner | Team lead | Payroll clerk | Employee |
|---|---|---|---|---|
| HR | Granted | Granted | Granted | No access |
| Finance | Granted | No access | Granted | No access |
| Tracking | Granted | Granted | No access | No access |
| Task Management | Granted | Granted | No access | Granted |
| Contracts | Granted | No access | Granted | No access |
| People & Roles | Granted | No access | No access | No access |
| Activity Log | Granted | No access | No access | No access |
| Work Grid | Granted | Granted | No access | Granted |
| Vaults | Granted | No access | No access | No access |
| Conversations | Granted | Granted | Granted | Granted |
Same grant, second question — who do they get to use it on?
Their own team. The same grant, attached here, reaches only the people in it.
A role says what someone can do; team scope says who they can do it to. The two are separate, because they answer different questions.
Pick the resources from the grid, pick the team from the scope, and the answer to “what can this person see?” stops depending on who remembers what you agreed.
The rows are real. The columns are yours.
Custom roles with per-resource permissions, so owners decide exactly what each person can see and do — and employees get self-service for their own basics without a manager in the loop.
Roles in a workspace
The four columns in the grid are an illustration of a shape, not a line-up that ships. You name the roles, and you set the permissions on each one resource by resource.
The split this page argues for is the one the app is already built on. The sidebar separates My Attendance and My Tasks — the things a person owns — from HR, Finance and Tracking, the things somebody administers.
The rows are real
Every row in the grid above is one of these. Nothing was invented for the diagram — every resource in the grid is an item from the product’s own navigation.
The point isn’t locking people out. It’s getting you out of the loop.
A manager approving things people could do for themselves isn’t control. It’s a queue, and you are the bottleneck in it.
Every row beside this is a message somebody no longer has to send you, and a reply you no longer have to remember to write.
- Ping a manager to mark them inCheck in and out
- Email the request, then chase itRequest leave
- Ask HR which days are offSee the holiday calendar
- Wait to be told what is nextManage their own tasks
People check in, request leave, see holidays and manage their own tasks without a manager bottleneck for daily things.
Any team past the point where one person can safely have access to everything.
It is usually one hire that moves a team across that line — the first person who needs one thing, and not everything.
Granular permissions are not an upsell
No team is too small to be past that line, which is the whole reason this is not held back for a bigger tier. There is no permissions add-on, no per-seat access fee, and nobody to phone before you decide who can open payroll.
Included on every plan — Free TrialStarterGrowthBusiness — and in full on the 30-day free trial.
The plan catalog lists “Roles & granular permissions” and “Employee self-service” among the features every plan includes. Plans differ on team size, storage and the extras built on top — never on who you are allowed to let in.
Compare the plansThe rest of the product
Roles and team scope run across the whole workspace. These are the other pages of it — explore the ones your team will use.
TRACK THE TIME
AttendanceEVERY PLANOne-tap check-in and out, on one live board.Time TrackingGROWTH+Work sessions on each task, from the desktop app.Leave & HolidaysEVERY PLANRequests, balances and public holidays.Access, answered
Does approving leave mean giving someone full admin?
No. Access is granted per resource rather than through a single admin switch, so the person who approves leave does not also have to be the person who can open payroll or change who else has access.
What is the difference between a role and team scope?
A role says what someone can do; team scope says who they can do it to. The two are separate, because they answer different questions.
Can we create our own roles, or is there a fixed list?
You create your own. Roles are custom, with permissions set per resource, so the four columns in the grid on this page are an illustration of a shape rather than a line-up that ships with the product.
What can an employee do without going through a manager?
People check in, request leave, see holidays and manage their own tasks without a manager bottleneck for daily things.
Is granular permission control an enterprise tier?
No. Roles and granular permissions, and employee self-service with them, are included on every plan including the 30-day free trial. There is no permissions add-on and no sales call to decide who can see what.
Does someone who runs pay have to be able to see time tracking?
Those are separate grants. Permissions are set per resource rather than through one admin switch, so running pay and reviewing tracked time do not have to arrive together as a bundle.
Decide once who can do what, then stop being asked.
Set the roles up this afternoon, scope them to the teams they belong to, and every daily question your team used to bring you answers itself.
Free for 30 days · No card needed · No enterprise tier required for permissions.