Roles and permissions
Ce contenu n’est pas encore disponible dans votre langue.
Access in dotby is two separate questions, and keeping them separate is what stops you over-promoting people.
- What can they reach? — the role, plus project membership.
- What can they change? — the role, plus individual capabilities.
The four roles
Section titled “The four roles”Every person in a workspace holds exactly one role. Each includes everything below it.
| Role | Reach | Adds |
|---|---|---|
| Admin | Everything | Workspace settings, billing, members, all permissions |
| Manager | Everything | Managing workspace content |
| Member | All public projects | The normal teammate |
| Guest | Only the projects they were added to | Nothing workspace-wide |
The important line is between member and guest. A member has workspace-wide reach by default. A guest has none — they see exactly what you shared and nothing else, including no member directory and no project list.
Guests
Section titled “Guests”Guests are for people outside your company: clients, contractors, reviewers, an auditor who needs to see one project for two weeks.
There are two kinds:
| Guest | Can | Costs |
|---|---|---|
| Viewer | Read | Free, unlimited, on every plan |
| Editor | Comment and edit | Counts against a per-seat allowance |
Editor guest allowance: 1 per seat on Free, 5 per seat on Pro. Viewer guests never count.
Within a project they were added to, a guest can be assigned work, comment, apply labels, and — if they are an editor guest — change task properties. They cannot create or rename your labels, and they cannot see anything outside that project.
Capabilities — hand over one right, not the keys
Section titled “Capabilities — hand over one right, not the keys”The classic mess: an operations lead needs to run onboarding, so they get made an admin and can now also delete a project and change billing.
Capabilities fix that. An admin can grant a manager one specific right from their row in the member roster, in two clicks.
| Capability | Grants |
|---|---|
audit.view |
The whole workspace audit log, unredacted. |
people.invite |
Invite new people. |
people.deactivate |
Deactivate and reactivate people below their own rank. |
Three rules worth knowing:
A capability only ever adds. It never removes a plan gate and never takes
anything away. audit.view on a Free workspace still needs Pro, because the
audit log is a Pro feature.
Only managers and admins can hold one. Members and guests cannot, by design. A manager already sees every project, which is what makes granting them a cross-workspace view safe.
Granting is written down. Every grant lands in the audit log, including the
grant of audit.view itself.
Two capabilities ask you to confirm before being granted — people.invite and
people.deactivate — because one spends a seat and the other cuts someone’s
access.
Private projects
Section titled “Private projects”A project is either:
- Public — everyone in the workspace can see it. The default.
- Private — only people explicitly added can see it, including admins.
That last part is not a bug. A private HR project should not be readable by whoever happens to hold the admin role this quarter. An admin can always add themselves — and that action is logged.
Time reporting
Section titled “Time reporting”Billable is an hours classification, not compensation. Every member sees and corrects only their own time. Admin and manager roles do not reveal another member’s entries, totals, timer, Task hours, or report through any client or API.
See Track time.
Deactivating someone
Section titled “Deactivating someone”Deactivation is soft. The person loses access immediately, but their history — comments, time entries, authored tasks — stays intact and correctly attributed. Work does not become anonymous because somebody left.
Reactivating restores access. Their role does not silently come back higher than it was.
Quick reference
Section titled “Quick reference”| Action | Guest | Member | Manager | Admin |
|---|---|---|---|---|
| See public projects | – | ✓ | ✓ | ✓ |
| See a project they were added to | ✓ | ✓ | ✓ | ✓ |
| Create and edit tasks | In their projects | ✓ | ✓ | ✓ |
| Create labels | – | ✓ | ✓ | ✓ |
| Delete a label | – | – | – | ✓ |
| Create projects | – | ✓ | ✓ | ✓ |
| Manage workspace content | – | – | ✓ | ✓ |
| Hold a capability | – | – | ✓ | ✓ (implicitly all) |
| Workspace settings and modules | – | – | – | ✓ |
| Billing | – | – | – | ✓ |
| Transfer the workspace | – | – | – | ✓ |
- Invite your team — the practical walkthrough.
- Workspace settings — modules and the audit log.
- Plans and billing — what a seat is.