Roles and permissions in full

Steerd is default-deny. A role grants exactly what is listed for it, plus any individual permissions somebody granted on top. Nothing is implied.

The roles

Role	What it allows
Owner	Everything, including billing. Created with the workspace, and the only role that can change the plan.
Admin	Everything except billing.
Member	The ordinary role: projects, CVs, contacts and organizations, their own time, their own trips.
Time tracker	A restricted role for external people. Time and travel only, scoped to the organizations and projects you grant, and default-denied everywhere else.

Every permission

Permission	What it allows	Grantable individually
Track time	Log and edit their own time entries. Everyone except a fully restricted account has this.	Yes
Manage time tracking	See and correct other people's time entries, and set the billing fields on an entry: billable, rate override and discount.	Yes
View CVs	Open and export CVs. Granted by every ordinary role, and ad-hoc grantable to a restricted one.	Yes
View everyone's CVs	See every CV in the team, not only their own. Without it, someone who can view CVs sees just their own record. Owner and admin have it; a member does not, and it can be granted individually.	Yes
Edit CVs	Create, edit and delete CVs, including photos and templates.	Yes
View projects	Open projects and follow the pipeline without changing anything. Managing projects requires this as well: a write permission on its own would still let someone read a project back by saving an empty change.	Yes
Manage projects	Create and edit projects, move them through the pipeline, and manage assignments. Held by owner, admin and member through their role, never granted individually.	No
Design the pipeline	Change the project stages themselves. Owner and admin only, deliberately: reshaping stages retroactively changes win rate and staleness for the whole team, so it is not something one member should do alone.	No
Manage billing	Change the plan, seats and payment method. The owner, and nobody else. It can never be granted individually, which is what stops an admin promoting themselves.	No
Manage members	Invite people, change roles and remove members. Never grantable individually, for the same reason as billing.	No
View invoices	Read invoices and the invoicing profile without being able to issue anything. This is the read-only assistant view.	Yes
Manage invoices	Create, edit, issue and correct invoices. This is the permission that writes money documents, so it is not grantable ad hoc.	No
Record trips	Create, edit and submit their own trips and receipts. An external contractor on the road legitimately holds this and nothing else.	Yes
Approve trips	Approve, reject, revert and export trips, and mark them reimbursed. Approving seals a trip, so this is a different job from recording one.	Yes
View contacts	Open contacts and their details. Owner, admin and member all have it, and it can be given to a restricted account on its own.	Yes
Manage contacts	Create, edit and delete contacts. Viewing them comes with it, because a write permission alone would still read a contact back through an empty change. Owner, admin and member hold it through their role; it is never granted individually.	No
View organizations	Open the companies behind the contacts. Owner, admin and member all have it.	Yes
Manage organizations	Create, edit and delete organizations. Owner and admin only: a member reads them but does not reshape them. Never granted individually.	No
View employees	Open employee records. On its own it shows only their own; seeing the rest of the team needs the next one. Owner, admin and member have it.	Yes
View all employees	See every employee record, not only their own. Owner and admin have it; a member does not, and it can be granted individually.	Yes
Manage employees	Create, edit and deactivate employee records. Owner and admin only, and never granted individually: it is a decision about the whole team rather than about one person.	No
See cost and billing rates	Read the money fields on an employee: cost rate and bill rate. This one works on fields rather than whole records, so the two columns disappear everywhere they would otherwise show. Owner and admin have it; a member does not.	Yes

Which role holds what

Granting one permission on its own

Under Manage access you can give a single person a permission their role does not include.

Three are deliberately excluded from that:

• Manage billing and manage members, because an admin who could grant those could promote themselves or somebody else. This is the escalation guard, and it is enforced by the server, not by hiding a button.
• Manage projects, because every non-restricted role already holds it through their role, so granting it individually would mean nothing.

Manage invoices is also role-derived rather than individually grantable: it writes money documents. The read-only view invoices is the one you grant to an assistant.

Scopes, for restricted roles

A time tracker is not merely short on permissions, it is scope-restricted: it sees only the organizations and projects explicitly granted to it. Grant nothing and it sees nothing, which is the safe default rather than a bug.

Why the sidebar differs per person

Steerd hides navigation the current account is not allowed to use, because the server would refuse anyway and a visible link to a 403 helps nobody. If a colleague describes a screen you cannot find, the question is which permission you are missing.