Roles and permissions

Access in dotby is two separate questions, and keeping them separate is what stops you over-promoting people.

1. What can they reach? — the role, plus project membership.
2. What can they change? — the role, plus individual capabilities.

The four roles

Every person in a workspace holds exactly one role. Each includes everything below it.

Role	Reach	Adds
Admin	Everything	Workspace settings, billing, members, all permissions
Manager	Everything	Managing workspace content
Member	All public projects	The normal teammate
Guest	Only the projects they were added to	Nothing workspace-wide

The important line is between member and guest. A member has workspace-wide reach by default. A guest has none — they see exactly what you shared and nothing else, including no member directory and no project list.

Guests

Guests are for people outside your company: clients, contractors, reviewers, an auditor who needs to see one project for two weeks.

There are two kinds:

Guest	Can	Costs
Viewer	Read	Free, unlimited, on every plan
Editor	Comment and edit	Counts against a per-seat allowance

Editor guest allowance: 1 per seat on Free, 5 per seat on Pro. Viewer guests never count.

Within a project they were added to, a guest can be assigned work, comment, apply labels, and — if they are an editor guest — change task properties. They cannot create or rename your labels, and they cannot see anything outside that project.

Capabilities — hand over one right, not the keys

The classic mess: your accountant needs the pay report, so they get made an admin, and now they can also delete a project and change billing.

Capabilities fix that. An admin can grant a manager one specific right from their row in the member roster, in two clicks.

Capability	Grants
time.viewAll	See every member’s timesheet — hours, tags, tasks. No money.
time.editAll	Edit or delete another member’s stopped time entry.
pay.viewAll	The pay report, money on timesheets, and CSV export.
audit.view	The whole workspace audit log, unredacted.
people.invite	Invite new people.
people.deactivate	Deactivate and reactivate people below their own rank.

Three rules worth knowing:

A capability only ever adds. It never removes a plan gate and never takes anything away. audit.view on a Free workspace still needs Pro, because the audit log is a Pro feature.

Only managers and admins can hold one. Members and guests cannot, by design. A manager already sees every project, which is what makes granting them a cross-workspace view safe.

Granting is written down. Every grant lands in the audit log, including the grant of audit.view itself.

Nota

time.viewAll and pay.viewAll are deliberately separate. “HR sees hours, finance sees money” is the common split, and bundling them would recreate the problem capabilities exist to solve.

Two capabilities ask you to confirm before being granted — people.invite and people.deactivate — because one spends a seat and the other cuts someone’s access.

Private projects

A project is either:

• Public — everyone in the workspace can see it. The default.
• Private — only people explicitly added can see it, including admins.

That last part is not a bug. A private HR project should not be readable by whoever happens to hold the admin role this quarter. An admin can always add themselves — and that action is logged.

Pay visibility

Money has its own switch, on top of pay.viewAll.

Turn pay visibility off for the whole workspace, or for one person at a time, and the amounts do not get blurred in the browser — they never reach the browser at all. There is no hidden DOM node to inspect.

This is what makes dotby usable for agencies: the client’s budget is not the freelancer’s business, and the freelancer’s rate is not the client’s.

See Track time.

Deactivating someone

Deactivation is soft. The person loses access immediately, but their history — comments, time entries, authored tasks — stays intact and correctly attributed. Work does not become anonymous because somebody left.

Reactivating restores access. Their role does not silently come back higher than it was.

Quick reference

Action	Guest	Member	Manager	Admin
See public projects	–	✓	✓	✓
See a project they were added to	✓	✓	✓	✓
Create and edit tasks	In their projects	✓	✓	✓
Create labels	–	✓	✓	✓
Delete a label	–	–	–	✓
Create projects	–	✓	✓	✓
Manage workspace content	–	–	✓	✓
Hold a capability	–	–	✓	✓ (implicitly all)
Workspace settings and modules	–	–	–	✓
Billing	–	–	–	✓
Transfer the workspace	–	–	–	✓

Next

• Invite your team — the practical walkthrough.
• Workspace settings — modules and the audit log.
• Plans and billing — what a seat is.