Roles and Permissions

ScopeStack uses a role-based access model to govern what users can see and do in different parts of the platform.

Accessing Roles

Navigate to Settings > Users & Groups > Roles to view and manage roles.

On this screen: A card headed “Roles” with a + Add A Role button at the top right. A data table lists all roles with two columns, Name and Default (a check mark for the account’s default role, a dash otherwise). Role names are clickable links, each with a pencil icon, that open the role editor. When one or more roles are selected via checkboxes, a batch action becomes active. There is no search bar on this list.

By default, new accounts start with three permission levels:

1. Admin
2. Sales
3. User

Roles are Additive

Roles in ScopeStack are additive, meaning:

1. Users may have multiple roles with different permission levels for a particular activity.
2. The platform determines a user’s permission for a specific activity by looking at the highest level of permission assigned to them across all of their roles.

For example, a user with two roles assigned:

1. One role gives them permission to Manage the Phases permission (under Settings).
2. The second role gives them only View permission on Phases.

That user has permission to manage Phases since the highest level assigned to them for that activity is Manage.

Viewing a User’s Privileges

You can see the full set of privileges any user has based on their assigned roles by navigating to that user in the Users list and clicking the Privileges tab on their detail page. This tab shows every permission the user holds across all of their roles, making it straightforward to audit access without reviewing each role individually.

On this screen: The user detail page with two tabs at the top: “User Info” and “Privileges.” The Privileges tab is selected, showing a striped table with three columns: Resource (the name of the permission area, formatted from internal identifiers such as “Projects Overview” or “Settings Account”), Description (a short explanation of what the permission controls), and Privilege (the level granted to this user, such as “View,” “Create,” or “Manage,” derived from the highest level across all of the user’s assigned roles).

Key Permissions

Request Approval

The Request Approval permission controls which users can submit projects through the approval workflow. Users without this permission will not be able to initiate the approval process for a project.

This permission is configured per role under the Projects section of the role editor. Assign it to roles held by presales engineers, project managers, or any other users who are responsible for submitting work for review.

If a user should be able to build and scope projects but not submit them for approval, set this permission to View in their role. It has no None level, and only Manage lets a user lock the project and request approval.

Vendor Resource Rate Editing

Accounts using vendor resources on projects can control who is permitted to edit the hourly cost and price for those resources. This permission is configured separately from general resource management, giving administrators precise control over cost and pricing data for vendor-sourced work.

Creating a New Role

Users with permission can create new roles by clicking the + Add A Role button in the header of the Roles card.

1. Give the new role a name.
2. Configure the permission settings for the activities in the platform to produce the desired access level.
3. Click Save, or Save and Add Another to save and start another role.
4. Assign the role to users.

Modifying an Existing Role

To modify an existing role, click on it in the role list.

1. Change the permissions you want to update.
2. Click Save when you’re done.

Default Role

One role is defined as the default role so that a user has some base level of access if no other role is assigned. This is particularly useful when using SSO to auto-provision new users. New users receive the default role when their accounts are created and can be assigned additional or different roles as needed.

Permission Reference

Each permission in the role editor controls access to a specific area of the platform. The editor groups them into three sections: Project Permissions, Settings Permissions and Reports Permissions. Most permissions have four levels: None (no access), View (read-only), Create (can create new items but not edit or delete existing ones) and Manage (full access). Some have fewer, and a few have a specialized level: Adjust Standards on the project-level Professional Services and Managed Services, and Purge on Project Overview.

Project permissions

Settings permissions

Reports permissions

Each of these decides whether a ScopeStack spreadsheet is offered in the project’s Generate Document dialog. Levels are None and View; the spreadsheet appears only with View.