Look up what each action needs, from the Admin role to an access level on a record, in one set of tables.
Who is this for
Admins
Permissions
Admin role to change access. Anyone can read this page.
Use this page to check what a person needs before they can do something. Each action needs either the Admin role or an access level on the entity or record. For the reasoning, and for how to grant access, see Access control.
What decides access
Base role. Every account is an Admin or a Member. There are no other base roles. Admins bypass every role restriction. They cannot bypass a feature switch: a module that is switched off is hidden from Admins too.
Access level. For Members, roles you grant per entity set a level on each row of the permissions grid: Hidden, Read only, Read / Write, Full Access or, on Comments rows only, Delete. Each row offers only some of these levels. Permissions add up across roles.
Staff field. The person named in a Staff-linked field on a record, such as its Owner, gets the levels set in that field's column of the grid, on that record only.
Your workspace may use different names for entities. The rows below use the default names.
Records
Action
What it needs
See a record in lists and open it
Read only or higher on the Record row. Records outside your reach do not appear.
Add a record, or duplicate one
The Add row. If the Add button for the record type is greyed out, hover over it to see why.
Edit a record's fields
Read / Write on the Record row, and the field not restricted to you.
Delete a record
Full Access on the Record row.
Deactivate or activate a staff record
Full Access on the Record row of Staff.
See inactive staff records
The Inactive Records row set to Read only, or the Admin role.
See a restricted field
Read only or higher on that field's row. Without it the field shows Restricted.
Edit a restricted field
Read / Write on that field's row.
Related records and sub-modules
Action
What it needs
See or change Tasks, Milestones, RAIDD entries, OKRs or Knowledge
The matching sub-module row on the parent record (for example Tasks on a Project). Their access follows the parent.
Add, edit and delete entries in a sub-module's tab on a record, such as Milestones
Full Access on its row, and Read / Write or higher on the parent record. Tasks and Sub-tasks are not added from a record's panel: create them from the Tasks page or the Gantt.
See Pulse, Allocation or Finance on a record
Read only or higher on that sub-module row.
See the Finance window and Current Rate on Staff
Access to the Finance sub-module on the Staff record.
Sub-tasks of a RAIDD entry
No access of their own. Whoever can see the entry sees its Sub-tasks, and whoever can edit the entry can edit them.
Restrict a single Task, Sub-task, Milestone, RAIDD entry, Objective, Key Result, SOW or Knowledge entry
Admin only.
Comments
For how comments work, see Comment on a record. The levels are set on the Comments row of the entity, or on a Comments on row of the parent for entries that follow a parent.
Action
What it needs
Read comments and replies
View access to the record, and Read only or higher on its Comments row.
Post a comment or reply
Read / Write or higher on the Comments row.
Edit a comment
Only its author, at Full Access or higher. Admins cannot edit other people's comments.
Delete your own comment
Full Access or higher on the Comments row.
Delete someone else's comment
Delete on the Comments row. Admins always have it.
Change who can comment
Admin only.
By default Public has Read / Write, Self has Full Access (for your own comments) and Admins have Delete.
Data in and out
Action
What it needs
Export to CSV or Excel
View access to the module. The file holds only what you can see.
Export to PowerPoint
View access to the module. The deck holds only what you can see.
Import data
Admin only.
Import finance, allocation or check-in data
Admin only.
Tabs, dashboards and links
Action
What it needs
Create, rename and delete your own tabs
Anyone with view access to the module. Tabs are personal.
Build or change your own dashboard
Anyone. Dashboards are personal.
Change a pinned dashboard or tab
Admin only. Members cannot edit, rename or delete them.
Save a tab as a preset, or manage presets
Admin only.
Open a shared link
Anyone who can sign in and already has access to the data. A link never grants access.
See a link between two records
Read access to both records. Otherwise the link does not appear.
Add or remove a typed link, such as Blocks, on the Links tab or the Gantt
Admin only.
Attach or detach a child, or set or replace a parent, on the Links tab
Every signed-in person can change their own photo, theme, mode and language in Your settings. Name and email come from your directory and cannot be edited in Gembaa.
Good to know
A feature switched off in Turn features on or off is hidden for everyone, Admins included. It is not a permission.
Access is deny by default. A new role grants nothing until you set its levels and assign it to someone.
A link to a record you cannot open shows Restricted in place of the record's name. Admins see the name.
No role takes access away. To reduce someone's reach, remove the role or group that gives it.
To see why one person can or cannot do something, use Explain access. See Access control.
