Feature 8 of 8 · Access
Access & Governance
Signing in only proves who someone is. What they can see and do follows what they are in the organisation: their role on each account and project, their reporting line, and the templates they hold.
Where access comes from
A role on each account
Viewer reads the delivery picture and published reports. Manager also reads the work and creates projects. Admin also edits the account and its members. Owner also leads every project under it.
A role on each project
The project's owner, and Lead, Member or Viewer, decide what someone does inside that project and nowhere else.
Grants, usually from templates
Permissions outside projects, each limited to a scope: everything, one project, what they own, their reporting line, the people they work alongside, or the people they created.
The administrator flag
Passes every check. Reserved for very few people; a template such as Workspace manager is preferred.
Templates
Named for the access they give, not for a job title. A designation can bring one with it.
| Template | Held by | Adds |
|---|---|---|
| Basic access | Everyone | Full control of projects they own; their own profile, leave and AI usage; the profiles and leave of the people allocated alongside them. |
| Resource | Automatically, with a resource profile | See every resource in the organisation, the org chart and workflows. |
| Line manager | Automatically, with direct reports | Over their reporting line: profiles, leave approval, attendance, allocation approval, AI usage. |
| Project manager | Product Manager designation, or by hand | Create projects. |
| Delivery manager | Delivery Manager designation, or by hand | Accounts, programmes and delivery models; create projects; allocations and AI usage organisation-wide. |
| Account owner | By hand | Create accounts and own each one; create projects only under them; create resources and manage only those. Sees nothing else. |
| Resource manager | Resource Manager designation, or by hand | Create and update people and their logins; approve leave; plan and approve allocations, organisation-wide. |
| Workspace manager | Workspace Manager designation, or by hand | Set the organisation up: branches, departments, designations, shifts, holidays, accounts, programmes and shared workflows. |
Safeguards
Prevent
No one raises their own access
The rights to manage templates and grant permissions are given to people by name only. No template carries them.
Contain
No one hands out more than they hold
Giving a designation gives its template, so the giver must hold everything that template carries, or PMO Assist refuses and names what is missing.
Stamp
Templates never change silently
Applying a template copies its grants; editing the template later doesn't quietly change what people already hold.
Expire
Time-limited access
Grants can carry an expiry date. Expired grants stop working but stay on record.
Record
A trail of changes
Work items keep every change. Milestones keep every re-baseline with its reason. Delivery reports keep every published revision.
Hide
Sensitive figures stay private
Rates and team cost are seen only by those who staff the project. Viewers never see drafts, work items or amounts.
Why it matters for leadership
- Least privilege by default, with access that follows the org chart as people move.
- Leaders can run their own accounts as Account owners without seeing, or changing, the rest of the organisation.
- Commercial data protected without hiding delivery health.
Step by step: Access and permissions in the User guide.