· 4 min read
What do the different user roles actually control?
The five roles — Owner, Admin, Estimator, Project Manager, Field Supervisor — and exactly what each can read and change.
Every permission below is checked on the server on every request — the interface hides buttons you can't use, but that's a convenience, not the actual security boundary. There are five roles.
| Role | What it can do | What it can't do |
|---|---|---|
| Owner | Everything below, plus the only role that can hold organization ownership itself. | There's exactly one Owner per organization — it moves only through a dedicated transfer, never an invite. |
| Admin | The same operational access as Owner: invite and manage users, full BOQ and Tendering access, full Schedule and Field Ops access, view the audit log. | Can't hold organization ownership itself. |
| Estimator | Build, edit, and approve BOQs; run tendering (create bid packages, invite subcontractors, award); approve variations; build assemblies. | Can't invite or manage users. Can view the schedule but not edit it. Can view Field Ops records but not create or edit them. |
| Project Manager | Full Schedule access; full Tendering access; full Field Ops access (diaries, HSE incidents, punch list); can view BOQs and manage variations. | Can't edit or approve a BOQ's content (view-only there). Can't invite users. Can manage a variation but the final approval step is Owner/Admin/Estimator only. |
| Field Supervisor | Full Field Ops access — log diary entries, report HSE incidents, manage the punch list. | No access to BOQ or Tendering. Can view the schedule but not edit it. Can't invite users. |
Two rules that apply regardless of role
- Four-eyes verification: some approvals specifically can't be done by the same person who did the original work, no matter what role they hold — see what that covers.
- Data isolation: role permissions control what a user can do within your organization. They have nothing to do with whether other organizations can see your data — that's a separate, database-level guarantee. See the glossary entry on multi-tenant data isolation.
Was this article helpful?