Roles & permissions
Compare provider and client permissions and manage team invitations.
On this page
Engagement displays two roles: Admin and Team member. Their permissions depend on whether the membership is on the provider side or belongs to a client. The original provider account owner is protected; it is not an extra selectable role.
Permission comparison
| Action | Provider admin | Provider team member | Client admin | Client team member |
|---|---|---|---|---|
| View provider internal work | Yes | Yes | No | No |
| View a client’s shared work | All provider clients | All provider clients | Own client | Own client |
| Create clients, projects, phases, and tasks | Yes | Yes | Request tasks only | Request tasks only |
| Accept or decline requests | Yes | Yes | No | No |
| Approve client completion | Yes | Yes | No | No |
| Update eligible client-owned tasks | Yes | Yes | Unassigned or assigned to self | Unassigned or assigned to self |
| Comment and upload on accessible active work | Yes | Yes | Shared work | Shared work |
| Delete accessible files on writable work | Yes | Yes | No | No |
| View audit or manage internal retainer time | Yes | Yes | No | No |
| Manage provider people and invitations | Yes | No | No | No |
| Invite a client admin | Yes | No | No | No |
| Manage own client’s members | Initial admin setup only | No | Yes | No |
| Manage billing and archive/restore workspace | Yes | No | No | No |
| Manage own profile | Yes | Yes | Yes | Yes |
Only the original provider account owner has Create another workspace in the current UI. An invited provider admin can administer billing and delivery without that creation control.
Invite provider staff
- As a provider admin, open Roles & invites in the sidebar.
- Choose Invite user for the provider team.
- Enter Email address and choose Role: Admin or Team member.
- Select Send invitation.
- Ask the recipient to accept the invitation with that email.
Provider membership and role changes apply across the provider’s workspaces. Check the intended role carefully before promoting, demoting, or removing someone.
Invite and manage client users
A provider admin uses Invite client admin to establish the client’s Admin. Provider-issued client invitations use the Admin role.
After joining, a client admin uses Roles & invites → Invite user, enters an email, selects Admin or Team member, and chooses Send invitation for their own client. They cannot invite or manage provider staff or another client’s users.
Providers do not generally demote or remove client members. When an existing client has no admin, the provider’s Set as client admin control can establish the first one.
Change roles and revoke invitations
Use the role controls in Roles & invites for members within your management scope. You cannot promote, demote, or remove yourself. The provider owner is protected, and the last client admin cannot be demoted or removed.
Pending invitations reserve seats and expire after seven days. Revoke invite cancels an unwanted pending invitation and frees its reserved seat. Accepted invitations are replaced by the member’s occupied seat.
The paid provider allowance is the original admin plus four staff; each client allows five people. The trial allows only the provider person and one client person. See plan limits.
When permissions look wrong
Check both your displayed role and membership side in Your profile. A client admin is still a client user: they cannot inspect provider-only work or override another named client assignee. Missing editing controls may also reflect read-only access.