Roles and permissions

Every person has one role in each firm. Stafio hides what a role may not use; it does not show it disabled. The API enforces the same rules, so nothing hidden on screen can be fetched another way.

What each role can do

Capability	Firm admin	Account manager	Delivery lead	Consultant	Finance	Contractor
Manage users, roles, hierarchy	Yes	No	No	No	No	No
View cost and bill rates	Yes	Own accounts, if approved	Only if approved	No	Yes	No
Create or edit accounts	Yes	Own accounts	No	No	No	No
Projects, milestones, tasks	Yes	Own accounts	Own projects	No	No	No
Submit own status and hours	Yes	Yes	Yes	Yes	Yes	Assigned projects
See others' status	All	Reporting line	Project members and reporting line	No	No	No
See others' hours	All	Their accounts	Their projects	No	All (not status text)	No
Approve timesheets	Yes	No	Own projects	No	No	No
Approve and send SOWs	Yes	Own accounts	No	No	No	No
CSV import and export	Yes	No	No	No	Export hours	No

Who can read a status update

A person can read a status item only if one of these is true:

It is their own.
They are the delivery lead of the item's project.
The author is in their reporting line, at any depth below them.
They are a firm admin.

Nobody else, including finance. A consultant or contractor never sees anyone else's status or any rate.

Financial visibility

Rates, SOW dollar totals, planned margin and the Margin Report are visible only to people a firm admin has approved for financial access. For everyone else these values are removed before they leave the server, and the Margin Report returns access denied. Every change to a person's financial access is recorded in the audit log.

Clients

Client contacts are not users. They open a SOW through a secure link and see only the document as approved. See Sending and signing.