In this article, we'll show you:
How to create a new role
How to configure component access for a role
How to restrict data access
How to restrict task access to a specific team
Video: Roles & Permissions System
Timestamps
0:02 – Introduction to the roles and permissions system
0:14 – Default roles and custom roles
0:56 – Role page structure: data access and component access
2:23 – Configuring component access (example)
5:18 – Configuring data access
7:26 – Restricting task access to teams
Step-by-step guide
Create a new role
In the roles and permissions system, you'll find three default roles. You can also create as many custom roles as you like, based on a default role or an already created custom role. This gives you a solid foundation instead of starting with empty permissions.
Go to Organization Settings and select the Role Management tab at the top.
Click New Role, give it a name (e.g. "Test Role") and, optionally, a description.
Choose which existing role the new role should be based on, e.g. the Manager role.
Understanding the role page layout
Every role consists of two main sections: Data Access and Component Access.
Component Access controls which areas of the software a role can access at all – such as the Dashboard with its sub-components like 3D Model, Weekly Plan, Weekly Preview and Schedule, plus further menu items like Data Analysis, Settings, Users and Resources. The Manager role has full access and edit rights to everything by default, while the Reader role only has limited access without edit rights.
Data Access, on the other hand, controls access to information across components – such as tasks and metrics (e.g. quantities, costs, hours) that appear in multiple places in the software.
Configuring component access
For each component, you can set very granular permissions – full access, view-only or usage rights, or no access at all. This is useful, for example, if you want to show external users only limited information or deliberately simplify the interface for certain team roles.
Open the relevant role and go to the Component Access section.
Restrict individual functions within a component, e.g. set Coloring to "view only" and disable Sharing, Object Archive and the measurement function.
Disable entire components the role shouldn't have access to, e.g. Schedule, Files, Tasks and Data Analysis.
Save the settings.
Assign the role to the relevant user.
In the project, the user will now only see the enabled components in the bar. For restricted functions like Coloring, for example, the option to create or edit colorings will be missing – existing ones can still be used.
Configuring data access
Unlike component access, data access works across components. If you turn off metrics here, for example, this information disappears everywhere it would otherwise be displayed – for instance in Data Analysis or the Weekly Preview.
There's also shared access for cross-functional elements like filters and the date picker. If you restrict filters here, for example, the role can't filter differently in any component – useful if you want to provide a pre-built filtered view and make sure it isn't changed.
In the Data Access section, open the relevant metrics and set them to no access if they shouldn't be visible for the role.
Adjust shared access if needed, e.g. for filters.
Save the settings.
Restricting task access to a team
By default, a role has access to all tasks and can see them all. The roles and permissions system also lets you restrict this further – for example, so that a role can see all tasks but only edit the tasks assigned to its own team. This setting builds on the Resources you set up previously, now found under the Teams tab.
Set the role's task access to "edit own team only" (or "view and edit own team only" for an even stricter restriction).
Go to the Teams tab (formerly Resources).
If needed, create a trade as a resource and add the user to that team.
Without an assigned team, a user with this setting can see all tasks but effectively can't edit any of them, since they don't belong to a team yet. Once a team is assigned, they can only edit tasks belonging to their own trade. If you also set that only the user's own team tasks should be visible, tasks from other teams disappear from the project entirely – the overall progress status in the model remains unaffected and still visible.