What a person may do in SAQ is decided by three things together: their workspace role, their client user mode if they belong to a client, and their project role on each project. An API token adds a fourth limit on top, its scopes, but never grants more than the person or agent behind it has.
The three dimensions
- Workspace role: Owner, Admin, or Member. Owners and Admins administer the whole workspace and see every project. Members see the projects they belong to. Client users have no workspace role; they belong to one client instead. See Role.
- Client user mode: a client user is regular until they are added to a project. Once added, they are elevated on that project, but only in a full-login session (password, passkey, or single sign-on; never a magic link). See Client user.
- Project role: Member or Project manager, per project. A Project manager can manage that project's members and settings. Owners and Admins act as manager on every project. See Project role.
Two rules cut across all of this. A ticket's reporter and its viewers can always see that ticket, whatever else applies. And a ticket someone may not see answers as not found, never as forbidden.
Permission matrix
"Project" in this table means a project the person belongs to; Owners and Admins belong to every project. "Elevated" assumes a full-login session.
| Capability | Owner / Admin | Member | Elevated client user | Regular client user |
|---|---|---|---|---|
| Organization billing, plan, audit log, export, workspace deletion | Owner only | No | No | No |
| Workspace, mailbox, and authentication settings | Yes | No | No | No |
| Close a period; billing runs | Yes | No | No | No |
| Categories, rate cards, policies, time banks | Yes | No | No | No |
| See rates and amounts | Yes | Report amounts for tickets they can see; not rate cards | No | No |
| Download client timesheets | All | With a client-wide grant, or own project as Project manager | Billing contacts only | Billing contacts only, with a full login |
| Corrections to closed time | Yes | No | No | No |
| Create clients, client users, contacts | Yes | No | No | No |
| Create projects; set billing client and mode | Yes | No | No | No |
| Add collaborating clients | Yes | As Project manager | No | No |
| Invite workspace users | Yes | No | No | No |
| Elevate client users | Yes | As Project manager, any client on the project | As Project manager, own client only | No |
| See the Inbox and triage it | Yes | Yes | No | No |
| Restricted review | Yes | Items that point at a ticket they may read | No | No |
| Move tickets between projects | Any; confirms a billing-client reset | Between own projects, when the billing client stays valid | No | No |
| See tickets | All | Own projects, Inbox, and tickets they report or view | Tickets billed to own client on the project, and tickets they report or view | Tickets they report or view |
| Set billing fields and estimate | Yes | On own projects and in the Inbox | No | No |
| Change kind | Yes | On own projects | Unless the ticket has unbilled billable time | No |
| Add and remove viewers | Workspace users, and users of clients on the project | Same, on own projects; Inbox: workspace users only | Users of own client; remove only viewers they added | Same as elevated |
| Start a ticket | Anywhere | Inbox and own projects | Inbox, and projects where own client bills, collaborates, or they are elevated | Inbox, and projects where own client bills or collaborates |
| Shared / Internal / Staff comments | All three | All three, on tickets they see | Shared and Internal on the project; Shared elsewhere | Shared only |
| Change assignee | Yes | On own projects and in the Inbox | On the project | No |
| Be assignee | Yes | Yes | On the project | No |
| Move state | Yes | On own projects and in the Inbox | On the project | Own tickets to the customer-resolve state only |
| Log time | Yes | Yes, on tickets in a project | No | No |
| Edit others' time | Yes | No | No | No |
| See time on tickets | Everything, including notes and non-billable time | Same | Billable minutes and whether they are billed | Same as elevated |
| See estimates | Yes | Yes | No | No |
| Log in with a magic link | No | No | Only until a password or passkey is set | Yes |
| API and MCP with a personal token | Yes (two-factor required) | Yes | Yes; the token must name at least one project; no triage scope | No |
Planning and assigning work for other people
SAQ has no planning, scheduling, or capacity module: no resource allocation, no availability calendar, no sprints. Work is planned on the ticket itself. Three questions come up often, and each has its own permission.
| What you want to do | Who may do it |
|---|---|
| Give a ticket to another person (set the assignee) | Owner, Admin, a full member of that ticket's project, or any workspace user on an Inbox ticket. The person you assign must be a workspace user, or a client user elevated on that project. See Update a ticket. |
| Set start and due dates, priority, and the estimate | The same people. Estimates and priorities are how upcoming work is ordered; see Update a ticket and Estimate. |
| Log or change time on behalf of somebody else | Nobody logs time for another person: every entry belongs to whoever created it. An Owner or Admin can edit or delete another person's entries in an open period, and correct them after a close. See Edit or delete a time entry. |
To see what a person has in front of them, open the board or the ticket list filtered by assignee, and use reports grouped by person for the hours already spent. A weekly target per person exists only as the advisory check in the period close checklist.
Read the page for your role
- Workspace member: tickets, boards, comments, time, reports, the Inbox.
- Project manager: what the project role adds on top of Member.
- Owner and Admin: everything an administrator configures, and where Owner and Admin differ.
- Client user: regular and elevated modes, and how to get a full login.
- Billing contact: downloading timesheets and following bank balances.
- AI agent account: token-only members for assistants and integrations.