Roles and permissions: who can see and do what

What you can see and do in BIMeta Business depends on two things: your firm role, which applies across the whole portal, and your project role on each project you're a team member of. This article explains every role in plain words, who must use two-factor sign-in, how project roles add to firm roles, and ends with a table comparing the sidebar of the four most common roles, including the pages inside each hub and on the Settings page.

Where to find it

Business Owners, Admins, IT Staff and HR can see everyone's roles under Admin → Settings → People & access and the full permission matrix under Admin → Settings → Roles & permissions. Project roles are set on each project's Team tab. Everyone else simply sees the result: the menu items and buttons their roles allow.

Who can use it

• Change someone's firm role (invite, change roles, deactivate, reset two-factor): Business Owner, Admin, IT Staff and Human Resources.
• Edit what a role is allowed to do (create roles, change the permission matrix): Business Owner and Admin.
• Add people to a project team and set their project role: anyone who can manage that project's team, typically the Project Manager.

How roles work

• A person can hold one or more firm roles. Their permissions are everything their roles allow, combined.
• The menu is built from those permissions: items you can't open aren't shown, and empty groups disappear.
• Every new firm starts with the default roles below. Business Owners and Admins can create new roles (starting from an existing one or from none) and adjust the permission matrix. The built-in system roles can't be deleted. So your firm's roles may differ slightly from the defaults described here.
• Hiding a menu item under Admin → Settings → Navigation never grants or removes access; only roles do.

The firm roles

Business Owner

Can do everything in the firm's portal, including things no other role can: billing and storage, choosing who approves BIM deployments, firm setup, pay and payroll, giving out the IT Staff role, letting BIMeta support look in (Support access), and accepting Custom Development proposals above the limit set for IT Staff and BIM Managers. Business Owners also run Background checks (Admin → Settings → Background checks) together with Admins, and a new firm's Owner goes through the guided onboarding and Setup, including the Setup step Background check that confirms who they are and that the business is real. A firm should have at least one Business Owner, ideally two. Business Owners keep their password even when single sign-on is required, so a broken identity provider can't lock the firm out. Two-factor sign-in is required.

Admin

Runs the firm day to day: projects, clients and pursuits, all of Finance, people and roles, firm settings on the Settings page (Setup, Navigation, Web address, Custom fields, Emails, Wording, Import from CSV, AI, Project assistant, Single sign-on, Background checks, People & access and Roles & permissions), bill and cost rates (Admin → Settings → Rates), the support desk, reports, the firm pages, field, bids, permits, marketing and the gallery, plus the BIM Manager panel. Admins can approve leave and run capacity. Admins do not get, by default: the IT hub, Custom Development, other people's personal files, privacy requests, pay and payroll, incident reports, billing, API and server access. Two-factor sign-in is required.

IT Staff

Everything a Project Manager can do, plus: the whole IT hub (overview, accounts and sessions, alerts, devices, software licences, security, the firewall with its bans, allow list and emergency lockdown, encryption keys, directory sync, connection check, maintenance windows, restores, retention and legal holds, storage cleanup, the IT report and audit export), Custom Development (ask BIMeta for custom work and accept proposals up to the limit the Owner sets), people and accounts (invite, change roles, deactivate, reset two-factor; view roles but not edit them), single sign-on, API keys and webhooks, the data API, integrations, the audit log, privacy requests, everyone's personal files, server access, desktop apps, the Software Hub, office servers and Drive & Blueprint, the support desk and knowledge base, project tabs, and viewing and approving BIM deployments. IT Staff never get HR records, firm settings or billing. Only a Business Owner can give someone the IT Staff role. Two-factor sign-in is required.

BIM Manager

Everything a Project Manager can do, plus the BIM Manager panel: model health, standards, family, detail and script libraries, BIM training, BIM plugins and program settings, deploying them to people's machines and approving deployments, the Revit add-in settings, Project tabs (on the Settings page) and Custom Development (ask BIMeta for custom work and accept proposals up to the limit the Owner sets). No server access, HR, billing or personal files, and never the deployment approval rule, which is the Business Owner's. Two-factor sign-in is required.

Project Manager

Runs projects across the firm. Everything a User can do, plus: create and edit projects, advance phases, see and manage budgets and scope, manage project teams, edit clients and write proposals, approve timesheets and expenses, see fee earned and reports, view invoices, run construction administration (RFIs, submittals, changes, closeout, legal holds), manage field reports, run bidding and permits, approve leave, see and book capacity, approve and download gallery work, see the marketing library and SF330s, and connect their own Outlook calendar. No firm settings, people administration or billing. Two-factor is optional unless the firm requires it.

Human Resources

People and HR records. Everything a User can do, plus: see and manage people and their accounts, run leave approvals, HR records, onboarding and offboarding, hiring, pay planning, payroll, the capacity board (view), handbook policies, compliance and incident reports, fee-earned and firm reports, and publish announcements and surveys. Never firm settings, billing or anyone's personal files. Two-factor sign-in is required.

User

The standard role for staff. A User can: see the dashboard, every project and every client, log their own time, claim their own expenses, request leave and keep their own licences and CE, use the HR self-service pages, raise support tickets and read the knowledge base, see and answer construction administration items in their court, see permits, take site photos and write daily logs in Field, ask the project assistant, add work to the gallery, reshare firm posts to LinkedIn, read firm announcements, goals and surveys, link BIMeta Drive and Blueprint, and manage their own password, two-factor and passkeys. Users can't create projects, approve anything, or see invoices, reports or admin pages unless given a project role that allows it. Two-factor is optional unless the firm requires it.

Client / Consultant

For people outside the firm, such as a client's representative or a structural engineer. On their own this role only lets them manage their own sign-in security. Everything else comes from their project role on the specific projects they're invited to, so they only ever see those projects. They don't have a dashboard: after signing in they land on Waiting on me (or their projects), and they can't schedule meetings from the top bar.

Background checks for team members

Whatever their role, people may be asked to pass a background check before they can use the portal, if the firm has switched that on under Admin → Settings → Background checks. See Background checks: check your team, new hires and vendors and Confirming your identity (when your firm asks for a background check).

Two-factor sign-in requirement

By default, two-factor sign-in is required for Business Owner, Admin, Human Resources, IT Staff and BIM Manager. People in those roles are sent to Settings → Security after signing in until they set it up (an authenticator app or a passkey both count). Your firm can also turn the requirement on for other roles under Admin → Settings → Roles & permissions, or for everyone under Admin → IT → Security. When people sign in through the firm's single sign-on and the firm trusts the provider's own check, BIMeta doesn't ask them to set up its two-factor as well. See Signing in to BIMeta Business.

Project roles

On each project's Team tab, people are added with a Project role. A project role adds permissions for that project only, on top of whatever the person's firm role allows everywhere.

For example, Leo Alvarez is a User at Northlight Architects, so he can see every project but edit none. Made Project Architect on 26-001 Riverbend Clinic Expansion, he can edit that project and see its budget, while other projects stay read-only for him.

Sidebar by role

This table shows what each of the four most common roles sees in the sidebar with the default roles, as captured at the example firm Northlight Architects. ✓ means the entry is in that role's sidebar; — means it isn't. Entries are listed in the sidebar's alphabetical order within each group.

Three entries are hubs (HR, Marketing and IT): one menu entry whose pages show as tabs at the top of the page. Settings is a single page in Admin that lists the firm's settings pages in sections. The rows marked ↳ under a hub or under Settings show which of its tabs or links each role gets. When someone can open only one page of a family there is no hub; that's why a User has Share to LinkedIn as its own entry instead of the Marketing hub.

Admin, Project Manager and Human Resources sit between these. A Project Manager's sidebar is like the BIM Manager's without the Admin group. Human Resources adds Capacity, Pay, Payroll and Compliance to the HR hub, plus Reports, and in Admin a Settings page with People & access and Roles & permissions. An Admin sees BIM Manager and a Settings page with most firm settings (including Background checks), but not the IT hub, Custom Development, privacy requests, personal files, pay and payroll, server access, API or billing.

Your firm may have changed roles or the menu layout, so your own sidebar can differ.

Tips and good to know

• Give people the least access they need. A User with a Project Manager project role on their own jobs is often better than a firm-wide Project Manager role.
• Pages and buttons check permissions on every use, so a link someone shares with you won't open a page your role doesn't allow.
• Inside a page, some buttons depend on permissions too: everyone can request leave, but only approvers see Approve.
• Changes to someone's roles apply the next time they open a page.
• Every role and permission change is recorded in the Audit log.

Troubleshooting / FAQ

Where did Roles & permissions (or another Admin page) go?

Firm settings pages are now gathered on Admin → Settings, and the IT pages are tabs of the IT hub. Your access to them hasn't changed. Press Ctrl K and type the page name to go straight there.

Why can't I see Reports?

Reports need the "see firm reports" permission, which Users don't have by default. Ask your Admin.

Why can I see a project but not edit it?

All staff can see every project, but editing needs a firm role like Project Manager or a project role like Project Architect or Designer on that project.

Why can't an Admin see someone's personal files?

By design. Only Business Owners and IT Staff the Owner appoints can look into personal files, and every look is audited.

Why was I asked to set up two-factor after my role changed?

Your new role requires it. Set it up under Settings → Security.