Manage workspace
Understand roles and permission ceilings
Learn why a role, a permission, and access to a particular resource are different.
Each person has one effective workspace role. A named role replaces the built-in permission set; it does not add a second role. Your current permissions and the particular resource's visibility together decide what you can do.
How the ceiling works
Role ceilings and resource access
- Starting role family→Allowed permission ceiling
- Allowed permission ceiling→Saved named-role permissions
- Saved named-role permissions→Participation and client-sharing limits
- Participation and client-sharing limits→Current resource access
- Current resource access→Action allowed only when all checks pass
- Owner-only controls→Cannot be added to a named role
- Platform authority→Cannot be added to a named role
A checked permission is not access to every project, ticket, or file. Membership, team and project inheritance, explicit grants, client organization, and internal-content visibility still apply. Owner-only authority remains outside a named role's ceiling.
- Owner controls ownership and the protected workspace policies.
- Admin manages normal administration within current permissions. An Admin-based named role can retain Admin-family capabilities, but not Owner-only controls.
- Manager, Member, and Viewer have different starting permissions. The workspace can narrow or configure those within the family's ceiling.
- Client admin and Client user remain within their own client organization and explicitly shared work. They cannot read internal notes.
Participation restrictions
Ticket participation: Internal notes, attachments and own time allows permitted internal collaboration on readable tickets, not public replies or client-facing ticket changes. Own-time access still requires current time-tracking authority. Allow establishing or expanding a client audience, when off, prevents expanding client access through invitations, sharing, and delegated actions. Neither setting grants resource access.
If an expected action is missing, ask your Owner to check your current role and the resource's sharing. Renaming a role or opening a direct link cannot raise its ceiling.