Roles and permissions

Timeora has two independent gates. A feature must be licensed before anybody in the organisation can use it, and a person must hold the permission for an action before they can perform it. Both gates have to pass.

Licence tiers

Your organisation’s tier decides which modules exist in the app at all. If a module is not part of your tier it does not appear in the navigation, even for an administrator.

Tier	Included modules
Free	Time tracking basics without the project, report and export modules.
Timeora Time	Reports, projects, activities, export and the punch clock.
Timeora One	Everything in Timeora Time plus accounting, CRM and tasks.

An administrator can see the current tier and licence state under the licence area of the app. Licence changes take effect the next time the app loads.

Permissions

Permissions are named <module>.<action>. Every module that stores data has the four standard actions — read, create, update and delete — and some have extra rights for tenant-wide visibility or adjustments.

Permission	Allows
timeEntries.read	See the time tracker and your own time entries.
timeEntries.create, timeEntries.update, timeEntries.delete	Record, edit and remove time entries.
projects.read	Open projects and use them in the timer.
projects.create, projects.update, projects.delete	Maintain the project list.
reports.read	Open reports.
reports.readAll	See tenant-wide report data rather than only your own scope.
export.read	Use the export module.
punchClock.adjust	Adjust attendance for the manager’s team.
punchClock.readAll	See attendance for everybody in the tenant.
users.read	Open Users & teams.
administration.roles.read, administration.roles.update	Open the role editor and change roles.
settings.update	Change organisation settings such as currency or working hours.

The full list lives with the role editor in Settings → Roles. A role can also hold *, which grants every permission.

Built-in roles

Every new tenant starts with three roles. Administrators can add more and change which permissions each role holds.

Role	Typical purpose
User	Track own time, record absences, read projects and activities, read CRM data and reports.
Manager	Everything a user can do, plus maintaining projects, activities and teams, managing users, closing and adjusting the team’s work time account, and reading tenant-wide reports.
Administrator	Full access through the * permission, including roles, settings and the licence.

A manager does not automatically see everybody’s attendance: punchClock.adjust covers the manager’s own team, while tenant-wide visibility is the administrator’s punchClock.readAll.

How the two gates appear in the app

• A missing feature flag removes the module from navigation. The route redirects to Home instead of showing an empty page.
• A missing permission hides the action or blocks the route. Read access usually decides whether the page opens at all; create, update and delete decide which buttons and row actions appear.
• Some pages open for read access but require an extra right for a specific control. For example, reports are readable with reports.read, while the role editor needs administration.roles.read and administration.roles.update to save changes.

If somebody cannot see something, check the tier first and the role second — in that order.