Role

What a person may do in SAQ follows from three things at once, their workspace role, their client mode, and their project role; this page gives the formula and points to the detailed role pages.

Written for
user, admin, integration-developer
Roles
owner, admin, member, project-manager, client-user, elevated-client-user, billing-contact, agent
Requires
Feature
members

SAQ has no permission editor and no custom roles. What a person may do is computed from three facts, and every screen, the API, and MCP apply the same rules:

capability = workspace role × client mode × project role

  • Workspace role applies to workspace users: Owner, Admin, or Member. Owners and Admins can do everything on every project and everything in settings; Owners alone manage the organization, plan, audit log, export, and deletion.
  • Client mode applies to client users: regular (own tickets, Shared comments) or elevated (their client's tickets on one project, Shared and Internal comments), plus the billing contact flag for downloading timesheets.
  • Project role applies per project to Members and to elevated client users: Member or Project manager. A workspace Member without a project role cannot work on that project's tickets.

Two things cut across the formula. A viewer grant opens one ticket to one person regardless of project membership. An API token narrows its holder's rights further by scope and project list, and some operations are never available to tokens.

How it relates to other concepts

  • The role pages describe each position in full: what they see, what they can do, and the tasks that matter to them.
  • An agent account is always a Member on every project.
  • Session strength is a fourth gate for a few actions: Owners and Admins need two-factor authentication; closing periods, billing runs, token minting, and similar actions need a recent re-authentication; elevation and billing-contact rights need a full login rather than a magic link.

Rules

  • A ticket someone may not see answers "not found", never "forbidden".
  • Time is logged by workspace users only, always as themselves.
  • Corrections, period close, billing runs, rates, policies, banks, client management, and workspace settings are Owner and Admin actions.
  • Billing fields and estimates are set by workspace users only.

Example

Per is a Member and Project manager on retail-shop. He edits tickets and adds members there, sees only his own tickets on other projects, and cannot change the project's billing client. Ola, an elevated client user on the same project, sees Nordic Retail's tickets there and nothing on Acme's other projects.

  • Documentation by role How workspace role, client user mode, and project role combine into what a person can do in SAQ, with the full permission matrix and a page for each role.
  • Owner and Admin Everything an Owner or Admin configures in SAQ, with links to each task, the differences between the two roles, and the two-factor requirement.
  • Workspace member What a Member does day to day in SAQ, with links to each task, and what a Member cannot do without the Owner or Admin role.
  • Project manager What the Project manager role adds on one project, what still needs an Owner or Admin, and the limits when the manager is an elevated client user.
  • Client user What a client user sees and can do in SAQ, the difference between regular and elevated mode, and how a full login unlocks elevation.
  • Billing contact What the Billing contact flag on a client user gives, how it differs from a billing recipient, and how timesheets and bank balances reach the client.
  • AI agent account What an agent account is in SAQ, how an Owner or Admin creates one, its scopes and keys, how its actions are attributed, and what it can never do.