Roles and Permissions

ScopeStack uses a role-based access model to govern what users can see and do in different parts of the platform.

Accessing Roles

Navigate to Settings > Users & Groups > Roles to view and manage roles.

On this screen: A card with a search bar to filter roles by name. Below the search bar, a data table lists all roles with a Name column. Role names are clickable links that open the role editor. When one or more roles are selected via checkboxes, a delete button becomes active. A + Add Role button appears at the bottom of the list.

By default, new accounts start with three permission levels:

1. Admin
2. Sales
3. User

Roles are Additive

Roles in ScopeStack are additive, meaning:

1. Users may have multiple roles with different permission levels for a particular activity.
2. The platform determines a user’s permission for a specific activity by looking at the highest level of permission assigned to them across all of their roles.

For example, a user with two roles assigned:

1. One role gives them permission to Manage the Phases permission (under Settings).
2. The second role gives them only View permission on Phases.

That user has permission to manage Phases since the highest level assigned to them for that activity is Manage.

Viewing a User’s Privileges

You can see the full set of privileges any user has based on their assigned roles by navigating to that user in the Users list and clicking the Privileges tab on their detail page. This tab shows every permission the user holds across all of their roles, making it straightforward to audit access without reviewing each role individually.

On this screen: The user detail page with two tabs at the top: “User Info” and “Privileges.” The Privileges tab is selected, showing a striped table with three columns: Resource (the name of the permission area, formatted from internal identifiers such as “Projects Overview” or “Settings Account”), Description (a short explanation of what the permission controls), and Privilege (the level granted to this user, such as “View,” “Create,” or “Manage,” derived from the highest level across all of the user’s assigned roles).

Key Permissions

Request Approval

The Request Approval permission controls which users can submit projects through the approval workflow. Users without this permission will not be able to initiate the approval process for a project.

This permission is configured per role under the Projects section of the role editor. Assign it to roles held by presales engineers, project managers, or any other users who are responsible for submitting work for review.

If a user should be able to build and scope projects but not submit them for approval, simply omit this permission from their role.

Vendor Resource Rate Editing

Accounts using vendor resources on projects can control who is permitted to edit the hourly cost and price for those resources. This permission is configured separately from general resource management, giving administrators precise control over cost and pricing data for vendor-sourced work.

Creating a New Role

Users with permission can create new roles by clicking the + Add Role button below the list of roles.

1. Give the new role a name.
2. Configure the permission settings for the activities in the platform to produce the desired access level.
3. Click Submit to save.
4. Assign the role to users.

Modifying an Existing Role

To modify an existing role, click on it in the role list.

1. Change the permissions you want to update.
2. Click Submit when you’re done.

Default Role

One role is defined as the default role so that a user has some base level of access if no other role is assigned. This is particularly useful when using SSO to auto-provision new users. New users receive the default role when their accounts are created and can be assigned additional or different roles as needed.

Permission Reference

Each permission in the role editor controls access to a specific area of the platform. Most permissions have three levels: None (no access), View (read-only), and Manage (full access). Some also have Create (can create new items but not edit/delete existing ones) or specialized levels like Adjust Standards for services.

Project permissions

Settings permissions