Permission Matrix

This guide details the complete permission matrix for the TimeTrack application, outlining the capabilities of each user role across all major features. Understanding this matrix is crucial for Admins and Owners to maintain proper organizational security and workflow.

1. User Role Definitions

The matrix tracks permissions for four distinct user roles:

Role	In-app label	Description
Owner	owner	Super Admin. Creates the company. Full platform access.
Admin	admin	Company Administrator. Broad management rights. Cannot create company.
Assign Manager	manager	Department/team manager. Manages projects, teams, tasks, and time approvals.
Assign Estimator	member	Standard contributor. Tracks time and views assigned projects.

2. Feature Permission Breakdown

The table below summarizes the Create, Read, Update, and Delete (CRUD) operations available for each feature by role.

Feature	Operation	Owner (O)	Admin (A)	Assign Manager (AM)	Assign Estimator (AE)
Company	Create	Yes	No	No	No
	Read	Yes	Yes	No	No
	Update	Yes	Yes	No	No
	Delete	No	No	No	No
User Management	Invite User (Below Role)	Yes	Yes	Yes	No
	Cancel Invitation	Yes	Yes	Yes (Self Invited)	No
	Suspend User	Yes	Yes	Yes (Self Invited)	No
Department	Create	Yes	Yes	No	No
	Read	Yes	Yes	Yes	Yes
	Update	Yes	Yes	Yes	No
	Delete	Yes	Yes	No	No
Team	Create	Yes	Yes	Yes	No
	Read	Yes	Yes	Yes	No
	Update	Yes	Yes	Yes	No
	Delete	Yes	Yes	Yes	No
Project	Create	Yes	Yes	Yes	No
	Read	Yes	Yes	Yes	Yes
	Update	Yes	Yes	Yes	No
	Delete	Yes	Yes	Yes	No
Task	Create	Yes	Yes	Yes	Yes
	Read	Yes	Yes	Yes	Yes
	Update	Yes	Yes	Yes	Yes
	Delete	Yes	Yes	Yes	No
Time Entry	Create	No	Yes	Yes	Yes
	Read	Yes	Yes	Yes	Yes
	Update	Yes	Yes	Yes	Yes (DRAFT ONLY)
	Delete	Yes	Yes	Yes	Yes (DRAFT ONLY)
Time Approval	Read	Yes	Yes	Yes	Yes
	Approval	Yes	Yes	Yes	No

3. Key Permission Details and Exceptions

A. Company & Administration

Company Creation: Only the Owner has the permission to create the company.
Company Deletion: No role is allowed to delete the company.
User Invitation: Owner, Admin, and Assign Managers can invite users at or below their own role level.
Invitation Cancellation: Assign Managers can only cancel invitations they have personally sent (Self Invited).
Suspend User: Assign Managers can only suspend users they have personally invited (Self Invited).

B. Project and Task Management

Project Creation: Owner, Admin, and Assign Managers can all Create, Update, and Delete projects. Assign Estimators can only Read projects.
Task Access: All roles including Assign Estimators can Create, Read, and Update tasks. Only Delete is restricted — Assign Estimators cannot delete tasks.

C. Time Tracking and Approval

Time Entry Creation: Owner cannot create time entries; this is restricted to Admin, Assign Manager, and Assign Estimator roles.
Time Entry Modification (Estimator): Assign Estimators can only Update or Delete their Time Entries if they are still in DRAFT status.
Time Approval: Only Owner, Admin, and Assign Manager roles have the Approval permission for time entries. Assign Estimators cannot approve time.