Roles and permissions
Access in dotby is two separate questions, and keeping them separate is what stops you over-promoting people.
- What can they reach? — the role, plus project membership.
- What can they change? — the role, plus individual capabilities.
The four roles
Section titled “The four roles”Every person in a workspace holds exactly one role. Each includes everything below it.
| Role | Reach | Adds |
|---|---|---|
| Admin | Everything | Workspace settings, billing, members, all permissions |
| Manager | Everything | Managing workspace content |
| Member | All public projects | The normal teammate |
| Guest | Only the projects they were added to | Nothing workspace-wide |
The important line is between member and guest. A member has workspace-wide reach by default. A guest has none — they see exactly what you shared and nothing else, including no member directory and no project list.
Guests
Section titled “Guests”Guests are for people outside your company: clients, contractors, reviewers, an auditor who needs to see one project for two weeks.
There are two kinds:
| Guest | Can | Costs |
|---|---|---|
| Viewer | Read | Free, unlimited, on every plan |
| Editor | Comment and edit | Counts against a per-seat allowance |
Editor guest allowance: 1 per seat on Free, 5 per seat on Pro. Viewer guests never count.
Within a project they were added to, a guest can be assigned work, comment, apply labels, and — if they are an editor guest — change task properties. They cannot create or rename your labels, and they cannot see anything outside that project.
Capabilities — hand over one right, not the keys
Section titled “Capabilities — hand over one right, not the keys”The classic mess: your accountant needs the pay report, so they get made an admin, and now they can also delete a project and change billing.
Capabilities fix that. An admin can grant a manager one specific right from their row in the member roster, in two clicks.
| Capability | Grants |
|---|---|
time.viewAll |
See every member’s timesheet — hours, tags, tasks. No money. |
time.editAll |
Edit or delete another member’s stopped time entry. |
pay.viewAll |
The pay report, money on timesheets, and CSV export. |
audit.view |
The whole workspace audit log, unredacted. |
people.invite |
Invite new people. |
people.deactivate |
Deactivate and reactivate people below their own rank. |
Three rules worth knowing:
A capability only ever adds. It never removes a plan gate and never takes
anything away. audit.view on a Free workspace still needs Pro, because the
audit log is a Pro feature.
Only managers and admins can hold one. Members and guests cannot, by design. A manager already sees every project, which is what makes granting them a cross-workspace view safe.
Granting is written down. Every grant lands in the audit log, including the
grant of audit.view itself.
Two capabilities ask you to confirm before being granted — people.invite and
people.deactivate — because one spends a seat and the other cuts someone’s
access.
Private projects
Section titled “Private projects”A project is either:
- Public — everyone in the workspace can see it. The default.
- Private — only people explicitly added can see it, including admins.
That last part is not a bug. A private HR project should not be readable by whoever happens to hold the admin role this quarter. An admin can always add themselves — and that action is logged.
Pay visibility
Section titled “Pay visibility”Money has its own switch, on top of pay.viewAll.
Turn pay visibility off for the whole workspace, or for one person at a time, and the amounts do not get blurred in the browser — they never reach the browser at all. There is no hidden DOM node to inspect.
This is what makes dotby usable for agencies: the client’s budget is not the freelancer’s business, and the freelancer’s rate is not the client’s.
See Track time.
Deactivating someone
Section titled “Deactivating someone”Deactivation is soft. The person loses access immediately, but their history — comments, time entries, authored tasks — stays intact and correctly attributed. Work does not become anonymous because somebody left.
Reactivating restores access. Their role does not silently come back higher than it was.
Quick reference
Section titled “Quick reference”| Action | Guest | Member | Manager | Admin |
|---|---|---|---|---|
| See public projects | – | ✓ | ✓ | ✓ |
| See a project they were added to | ✓ | ✓ | ✓ | ✓ |
| Create and edit tasks | In their projects | ✓ | ✓ | ✓ |
| Create labels | – | ✓ | ✓ | ✓ |
| Delete a label | – | – | – | ✓ |
| Create projects | – | ✓ | ✓ | ✓ |
| Manage workspace content | – | – | ✓ | ✓ |
| Hold a capability | – | – | ✓ | ✓ (implicitly all) |
| Workspace settings and modules | – | – | – | ✓ |
| Billing | – | – | – | ✓ |
| Transfer the workspace | – | – | – | ✓ |
- Invite your team — the practical walkthrough.
- Workspace settings — modules and the audit log.
- Plans and billing — what a seat is.