User guide · Admin
Access and permissions
Signing in only proves who you are. Everything you may do is decided by PMO Assist from four sources: your role on each account, your role on each project, the grants you hold (usually from templates), and, for very few people, the administrator flag.
1 · Account roles
A role on an account reaches every project under it, with no project membership.
| Role | Sees | Can also |
|---|---|---|
| Viewer | Overview, plan, published reports and team of every project under it. Not work items or sprints. | — |
| Manager | The same, plus work items and sprints. | Create projects under it; write and publish its projects' reports. |
| Admin | As a manager. | Edit the account, its programmes and members; manage project members. |
| Owner | As a manager. | All an admin does, and work as lead on every project under it. |
Give roles under Accounts›the account›Members. See Managing members.
2 · Project roles
| Permission | Owner | Lead | Member | Viewer |
|---|---|---|---|---|
| Read the project, sprints, work items, reports, who is allocated | ✓ | ✓ | ✓ | ✓ |
| Create and update work items; log own time | ✓ | ✓ | ✓ | – |
| Delete and assign work items; create and run sprints | ✓ | ✓ | – | – |
| Edit project details and settings; add members | ✓ | ✓ | – | – |
| See, edit and delete everyone's time; export reports | ✓ | ✓ | – | – |
| Propose and adjust allocations; see the project's AI usage | ✓ | ✓ | – | – |
| Change a role, remove a member, archive, delete | ✓ | – | – | – |
The owner always leads their project. An account's Admin and Owner can also change roles and remove members on its projects.
3 · Grants and templates
A grant is a permission at a scope. A template is a named set of grants; applying one copies its grants to the person, so editing the template later never silently changes what people hold.
| Scope | Covers |
|---|---|
| Global | Everything, everywhere. |
| Project | One named project. |
| Owned | What you created or own: your projects, your profile, your AI calls. |
| Reports of | Everyone in your reporting line, all the way down. |
| Project resource | The people allocated alongside you on your projects. |
| Created | The resources you created, and what is about them. |
| Template | Held by | Adds |
|---|---|---|
| Basic access | Every user | Use AI; full control of projects they own, including staffing them; their own profile, leave and AI usage; profiles and leave of people allocated alongside them. |
| Resource | Automatically, with a resource profile | See every resource, the org chart, user accounts and workflows. |
| Line manager | Automatically, with direct reports | Over their reporting line: read and update profiles, read and approve leave, read attendance, approve allocations, see AI usage. |
| Project manager | Product Manager designation, or by hand | Create projects. |
| Delivery manager | Delivery Manager designation, or by hand | Manage accounts, programmes and delivery models; create projects; see allocations and AI usage organisation-wide. |
| Account owner | By hand | Create accounts and own each; create projects under them only; create resources and manage only those. Sees nothing else. |
| Resource manager | Resource Manager designation, or by hand | Create and update resources and logins; read and approve leave; correct attendance; plan, change and approve allocations, organisation-wide. |
| Workspace manager | Workspace Manager designation, or by hand | Branches, departments, designations, shifts, holidays, accounts, programmes and shared workflows. Creates no projects and no resources. |
- Designations bring templates. Giving someone a designation gives its template, so you can give it only if you hold everything it carries, or hold the right to grant permissions, or are an administrator. A Resource manager can hire developers but not Product, Delivery or Workspace managers.
- The Account Product Manager designation carries no template. With the Manager role on an account, its holder creates projects there and nowhere else.
- Grants can expire. An expired grant stops working but stays on record.
- Nobody raises their own access. Managing templates and granting permissions are given to people by name; no template carries them.
4 · The administrator flag
An administrator passes every check. Only administrators set it, on a person's Access›Account card. Prefer a template such as Workspace manager. Test and demonstrate the product as ordinary people, so you see what they see.
Giving access
Grant permissions or Admin
- Open the person's page, then the Access tab.
- Apply a template to write its grants onto the person; hand-made grants are kept. Or give a single grant.
- Revoke a grant from the Permissions card.
A change applies from the person's next request; they reload the page to see it.
Getting more access
- For a project: ask its lead to add you, or its owner to change your role.
- For an account: ask its Admin or Owner for a role.
- For anything else: ask someone who grants permissions, often an administrator, for a template or a grant.