Roles & permissions: the permission matrix

Roles & permissions shows, on one page, exactly what each firm role is allowed to do. Every row is one permission (a single thing someone may see or do, such as Approve or send back submitted timesheets); every column is a role; a tick means the role includes that permission. Use it to answer "who can approve expenses?" or "what will a Project Manager see?", and, if you're allowed, to create roles that fit your firm.

Where to find it

• Sidebar → Admin → Settings, then Roles & permissions in the People and access section. (The Settings page gathers the firm's settings pages in one place; you can also type in its Search settings box.) A ← Settings link at the top of the page takes you back to the Settings page.
• Press Ctrl K and type roles, permissions or access rights.
• Setup step 12, Roles & permissions (in the Your team section), links here with Review roles & permissions.

Who can use it

• Viewing the matrix: Business Owner, Admin, IT Staff and Human Resources.
• Creating and editing roles: Business Owner and Admin. IT Staff and Human Resources see the matrix read-only, without the New role form and without links on the role names.
• Even with the right to edit roles, you can never edit the Business Owner role, or any role you hold yourself. Those column headings are plain text instead of links. This stops anyone raising their own access or locking themselves out.

How roles work

• Firm roles apply everywhere in your portal. A person can hold several; they get every permission any of their roles includes. You give people roles under Admin → Settings → People & access.
• Project roles (Project Manager, Project Architect, Designer, Consultant, Client) are set per project on its Team tab and add permissions inside that project only. They aren't shown in this matrix. See Roles and permissions: who can see and do what.
• The sidebar is built from permissions: a menu item only appears for people whose roles allow the page. Hiding a menu item under Admin → Settings → Navigation never grants or removes access.
• Some roles require two-factor sign-in. By default these are Business Owner, Admin, IT Staff, BIM Manager and Human Resources. People with such a role must set up an authenticator app or a passkey before they can use the portal.
• The built-in roles can't be deleted. There's no delete for custom roles either; to retire one, take it away from everyone under People & access.

A tour of the page

New role (Owners and Admins)

A bar across the top with:

• New role: the name of the role, for example Office Manager or Marketing Coordinator (placeholder e.g. Project Manager). Required, up to 120 characters.
• Start from: No permissions, or any existing role to copy its permissions as a starting point.
• Create role: creates the role and opens its edit page.

The matrix

The first column, Permission, describes each permission in plain words. The other columns are your firm's roles in the order they were created: Business Owner, Admin, Project Manager, IT Staff, BIM Manager, Human Resources, User and Client / Consultant in a new firm, followed by any roles you add. A tick means "allowed"; an empty cell means "not allowed". If you can edit a role, its column heading is a link to its edit page (see Editing a role).

Permissions are grouped into sections with small capital headings, one per part of BIMeta: Dashboard, Projects, People & access, Clients & Pursuits, Time & fee earned, Finance, Team & HR, Support & Knowledge Base, Firm, Reports, Construction Admin, Field, Bidding, Permits, Marketing, Visualization Gallery, Assistant, Integrations, Firm settings, Your account, Personal files, Privacy, Billing & storage, Desktop apps, Drive & Blueprint, Server access, Push, Project tabs, BIM Manager, API & connected apps, IT overview and Custom Development.

The standard permission matrix

This is the matrix every new firm starts with (your firm's may differ if roles have been edited). Read it as a reference: find the job, then see which roles have a tick.

The roles in short

• Business Owner: everything, including things only an Owner has by default: billing and storage, pay and payroll, HR records and incidents, choosing who approves BIM deployments, and giving out the Owner and IT Staff roles.
• Admin: runs the firm day to day, including all firm settings (setup, navigation, web address, custom fields, emails, wording, import, single sign-on, AI, API keys, the audit log). Not: IT pages, Custom Development, everyone's personal files, privacy requests, pay, payroll, HR records, incidents, billing, server access or project tabs.
• Project Manager: a User plus running projects: create and edit projects, budgets and teams, approve time and expenses, construction admin, bidding, permits, capacity, reports.
• IT Staff: a Project Manager plus accounts and security: invite and manage people (see roles but not edit them), single sign-on, API, integrations, the audit log, privacy requests, everyone's personal files, server access, desktop apps, Drive & Blueprint, the support desk, every IT page, and asking BIMeta for custom development (Admin → Custom Development).
• BIM Manager: a Project Manager plus the BIM Manager panel, project tabs and asking BIMeta for custom development (Admin → Custom Development).
• Human Resources: a User plus people and all HR work: accounts, leave, hiring, onboarding, pay planning, payroll, policies, compliance, incidents and HR records, announcements and surveys.
• User: the standard staff role: see projects and clients, log time, claim expenses, request leave, raise support tickets, field capture and so on.
• Client / Consultant: for outside people. On its own it only allows managing their own sign-in security; what they see comes from project roles.

How to create a role

1. In New role, type a name, for example Office Manager.
2. In Start from, pick the closest existing role, or No permissions to start empty.
3. Click Create role. You'll see Role Office Manager created and land on the role's edit page.
4. Tick or untick permissions, decide whether the role requires two-factor sign-in, and click Save role.
5. Give the role to people under Admin → Settings → People & access.

Good to know:

• A copy only carries the permissions you hold. If an Admin copies the Human Resources role, the HR-only permissions (pay, payroll, records, incidents, hiring…) are left out of the copy.
• New roles don't require two-factor until you tick that box on the edit page.
• The Audit log records people.role_created, with the role it was copied from.

Tips and good to know

• Prefer giving people an extra role over editing a built-in one. If Project Managers at your firm should also see invoices for every project, it may be cleaner to create a Senior PM role than to change Project Manager for everyone.
• Changes to a role apply to everyone who holds it on their next click.
• Permissions with "(Owners and IT only)" or "(HR only; never Admins by default)" in their description are deliberately kept away from Admins in the standard roles. Because nobody can give a permission they don't hold, only a Business Owner can grant them.
• Permissions for parts of BIMeta your plan doesn't include grant nothing, even when ticked.

Troubleshooting

Why can't I click a role's name to edit it?

Either you can only view roles, the role is Business Owner, or you hold that role yourself. Ask a Business Owner.

There's no New role form.

Your role can see the matrix but not change roles. IT Staff and Human Resources are in this position by default.

Someone has a permission but still can't see the page.

Check that the page belongs to a part of BIMeta included in your plan (Admin → Settings → Setup, step 6 Modules & integrations (in the Your firm section)), and that the person has signed in since the change. Some pages also need a project role on that particular project.