> ## Documentation Index
> Fetch the complete documentation index at: https://beebole.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Roles and permissions: control who sees what
> Create roles in Beebole and set Edit and View permissions for timesheets, billing, time off, reports, and more, each scoped to the right people.
A role in Beebole is a named set of permissions that controls what its holders can see and do. Every person has exactly one role, and each permission in a role sets two levels — **View** and **Edit** — scoped to targets such as **Me**, **Managed people**, or **Managed projects**. This page explains how roles work and what every permission controls.
Roles control what a person's role lets them **do** — view or edit data. Which projects, time off types, and expense types are **available** to each person is a separate system, covered in [Assignments](/help/documentation/assignments).
## How roles work
Roles live in **Settings** > **Person Roles** — click the button with your initials at the bottom of the sidebar to open **Settings**. Each role is a grid of permissions with three pieces:
* **Permission** — the area of Beebole it controls, such as **Timesheet entries** or **Billing rates**.
* **Edit** — the targets whose data the role can create, change, or delete.
* **View** — the targets whose data the role can see.
A permission with nothing selected shows **Not allowed**: people with that role don't see that area at all. Some permissions — mostly account-wide definitions like **Define time off** or **Tags** — are simple on/off checkboxes instead of target selectors.
Edit access always includes view access. When you add a target under **Edit**, Beebole adds it to **View** automatically; when you remove a target from **View**, it is removed from **Edit** too.
At the top of the grid, the **Admin role (full access)** checkbox grants everything at once. Checking it replaces all individual permissions with full access; unchecking it clears the role so you can build it permission by permission.
A few permissions — such as **Billing rates**, **Costs**, **Project budgets**, and **Time off balance** — correspond to features included in higher-tier plans. If your subscription doesn't include the feature, the permission has no effect, even for admins.
## Creating and managing roles
Click the button with your initials at the bottom of the sidebar to open **Settings**, then click **Person Roles**.
Click **Add a role** and type a name — for example Editor, Staff, or Project Lead.
For each permission, pick targets under **Edit** and **View**, or check the **Admin role (full access)** box for full access. Use the **Search…** field to find a permission by name.
There is no Save button — every change to a role is saved automatically and applies to everyone holding that role.
To manage an existing role, open its **⋯** action menu in the roles list: **Duplicate** copies the role with all its permissions, **Archive** hides it, and **Delete** removes it.
Start from a role that is close to what you need and use **Duplicate**, then adjust the copy. It is faster than building a role from scratch and you are less likely to miss a permission.
Every new Beebole account starts with three roles: **Admin** (full access), **Manager**, and **Employee**. You can edit them, duplicate them, or add your own.
## Permission scopes
For permissions with target selectors, the targets you pick under **Edit** and **View** define whose data the permission covers. Each permission only offers the targets that make sense for it.
| Target | Who or what it covers |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| The targets separate what the person *manages* from their *colleagues* — and, for tasks, what they *own* from what they *manage*: | |
| Target | Who or what it covers |
| --------------------------- | ---------------------------------------------------------- |
| **All** | No restriction — every target at once |
| **Me** | The person's own data |
| **Managed people** | People they manage, directly or through tags they manage |
| **Team colleagues** | People who share the same managers |
| **Project colleagues** | People assigned to the same projects |
| **Task colleagues** | People assigned to the same tasks |
| **Managed project members** | People assigned to the projects they manage |
| **Managed projects** | Projects they manage, directly or through tags they manage |
| **Assigned projects** | Projects assigned to them |
| **Owned tasks** | Tasks they own |
| **Managed tasks** | Tasks they manage |
| **Assigned tasks** | Tasks assigned to them |
| **Managed tags** | Tags they manage, including descendant tags |
| **Global settings** | The organization-wide value of the setting |
For example, a team leader role could have **Timesheet entries** set to **Edit: Managed people** and **View: Managed people, Project colleagues** — they can correct their own team's timesheets and see, but not change, entries from project colleagues.
## Timesheet, time off, and schedule permissions
These permissions control day-to-day time tracking data.
| Permission | What it controls |
| ----------------------------------- | --------------------------------------------------------------------------- |
| **Timesheet entries** | Time entries on timesheets — scoped by people, projects, and tasks |
| **Timesheet and planning settings** | The timesheet and planning configuration panel on people and on the account |
| **Valid period for time entry** | The setting that limits how far back or forward time can be entered |
| **Define time off** | Creating and configuring time off types (on/off) |
| **Time off balance** | People's time off allowances and balances |
| **Holidays** | Public holiday calendars assigned to people |
| **Schedule assignment** | Which work schedule is assigned to a person, tag, or the account |
| **Define schedules** | Creating and editing work schedules (on/off) |
## Approval permissions
| Permission | What it controls |
| --------------------- | ------------------------------------------------------------------------------------------ |
| **Approval workflow** | The approval stages configured on the account and on people |
| **Approval events** | Approval activity — submissions, approvals, and rejections — scoped by people and projects |
A manager who approves timesheets needs **Approval events** edit access for their team; only admins who design the flow need **Approval workflow**.
## Billing, cost, and budget permissions
| Permission | What it controls |
| ------------------- | ------------------------------------ |
| **Billing rates** | Billing rates on people and projects |
| **Costs** | Cost rates on people and projects |
| **Project budgets** | Budgets defined on projects |
Financial data is hidden from anyone whose role has these set to **Not allowed** — they don't see billing or cost amounts anywhere in Beebole, including reports.
## Expense permissions
| Permission | What it controls |
| ------------------- | ----------------------------------------------- |
| **Define Expenses** | Creating and configuring expense types (on/off) |
| **Expense records** | Expense entries, scoped by people and projects |
## People permissions
| Permission | What it controls |
| ------------------ | ------------------------------------------------------------------- |
| **People details** | People's profiles — names, pictures, and profile data |
| **User account** | The **Email & role** panel — a person's email, invitation, and role |
| **Manager** | Seeing and changing who a person manages |
| **Managed people** | Seeing and changing who manages a person |
Be deliberate with **User account** edit access: whoever holds it can change other people's roles.
## Project, task, and tag permissions
| Permission | What it controls |
| ---------------------- | ---------------------------------------------------------------------------------------- |
| **Project details** | Projects — creating, editing, and archiving them |
| **Secondary projects** | The secondary projects allowed on a project |
| **Tasks** | Tasks in Planning — scoped to **Owned tasks**, **Managed tasks**, and **Assigned tasks** |
| **Tags** | Creating and managing tags (on/off) |
## Assignment permissions
Assignment permissions separate *changing data* from *deciding who works on what*. A role can be allowed to edit projects without being allowed to assign people to them — or the reverse. When a role lacks an assignment permission, the matching controls simply don't appear for its holders.
| Permission | What it controls |
| --------------------------- | -------------------------------------------------- |
| **Assign people managers** | Who is set as a person's manager |
| **Assign project managers** | Who manages a project |
| **Assign task managers** | Who manages a task |
| **Assign tag managers** | Who manages a tag |
| **Assign task owner** | Setting the owner of a task |
| **Potential owners** | Assigning tasks to people |
| **Who has access** | Assigning people to projects |
| **Assign schedules** | Which work schedule is assigned to a person or tag |
| **Assign time off** | Which time off types are available to a person |
| **Assign expenses** | Which expense types are available to a person |
| **Assign custom fields** | Which custom fields are available to a person |
| **Apply tags** | Applying tags to people, projects, and tasks |
The permission list is long. Use the search box at the top of the role's permission panel to jump straight to the permission you're looking for.
## Custom field permissions
| Permission | What it controls |
| ------------------------ | ----------------------------------------------- |
| **Define Custom Fields** | Creating and configuring custom fields (on/off) |
| **Custom fields values** | The values filled in on people and projects |
## Journal and report permissions
| Permission | What it controls |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Journal** | Journal messages on people, projects, and tasks |
| **Journal feed** | The **Journal** page in the sidebar |
| **Reports** | The **Reports** page, scoped by people and projects |
| **Timesheet compliance** | The [Timesheet Compliance report](/help/documentation/reports#timesheet-compliance) — managers see the people they manage; admins see everyone |
| **Billable utilization** | The [Utilization report](/help/documentation/reports#utilization) |
## Account and visibility permissions
These permissions cover account configuration and the access-control settings themselves.
| Permission | What it controls |
| --------------------------- | ------------------------------------------------------------------------------------------ |
| **Global settings** | The organization's account settings (on/off) |
| **Localization** | Language, time zone, and format settings on people and the account |
| **Single sign-on (SSO)** | The SSO configuration on the account |
| **Templates for emails** | The email templates Beebole sends |
| **Notification settings** | Notification preferences on people and the account |
| **Notification history** | The list of notifications already sent (on/off) |
| **Push notifications** | Browser push notification subscriptions (on/off) |
| **Show or hide** | The **Show or Hide** panels on people, tags, and projects |
| **Show or hide by default** | The account-wide **Show or hide by default** settings |
| **Related items** | The **Who has access?** panels on projects, time off types, expense types, and other items |
| **Description** | The description panel on people, projects, tasks, and the account |
The last four are the controls described in [Assignments](/help/documentation/assignments) — a role needs them to manage who has access to what.
## Assigning a role to a person
Click **People** in the sidebar and click the person's name.
In the person's details, open the **Email & role** panel.
Next to **Role**, click the current role and choose another one from the **Choose a role** selector. The change is saved automatically.
## Best practices
* **Grant the least access that works.** Start from **Not allowed** and add **View** before **Edit**, only for the targets each role really needs.
* **Name roles after responsibilities.** Names like Project Lead or Finance make it obvious who should hold them.
* **Prefer few roles over many.** Targets like **Managed people** and **Managed projects** adapt to each holder, so one Manager role can serve every manager.
* **Review roles when your structure changes.** Targets follow manager and tag relationships — check that permissions still reach the right people after a reorganization.
## Related content
Control which projects, time off types, and expense types are available to each person.
Add and invite team members, and manage their profiles and roles.
Group people and projects with tags — several permission targets follow tag managers.
Configure the organization-wide settings that several permissions gate.
## Frequently asked questions
Roles control what a person can do: view or edit timesheets, billing rates, reports, and so on. Assignments control which items are available to them: which projects they can log time against, or which time off types they can pick. Beebole applies both — a person needs the permission and the item.
No. Each person in Beebole holds exactly one role. If someone needs a mix of permissions from two roles, duplicate one of them and adjust the copy.
For each permission, **View** lets the role see the data and **Edit** lets it create, change, or delete it, each scoped to the targets you select. A permission with no targets selected shows **Not allowed**, and that area of Beebole is hidden from the role entirely.
Every new account starts with **Admin**, **Manager**, and **Employee**. The Admin role has the **Admin role (full access)** box checked, which grants every permission. You can edit these roles or add your own.
No. Beebole saves every change to a role automatically — adding a target, unchecking a permission, or renaming the role. There is no Save button on the roles page.